ITPEC FE Morning April 2019 Question 36
The IP address of Server X prepared by an attacker was stored in a DNS cache server of Company B as the IP address corresponding to the FQDN of the web server of Company A. Which of the following users will be unintentionally guided to Server X because of this attack? Here, each employee of Company A and Company B performs name resolution by using the DNS cache server of his/her own company.
Explanation
A Company B employee accessing the web server of Company A — the poisoned record sits in Company B's DNS cache and is for Company A's web server name.
A user is sent to Server X only if both of these hold:
- •the user resolves names through the poisoned server, the DNS cache server of Company B, so the user is an employee of Company B
- •the name looked up is the poisoned one, the FQDN of the web server of Company A
Only option (c) meets both.
Answer (c)
Why not others:
- •(a) — an employee of Company A uses Company A's own DNS cache server, which holds the correct address
- •(b) — uses Company A's DNS cache server, and looks up Company B's web server, a name that was not poisoned anyway
- •(d) — uses the poisoned cache server, but looks up Company B's own web server, whose record is intact
Key rule: DNS cache poisoning misleads only the clients of the poisoned cache server, and only for the names whose records were falsified, until the false entry expires.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.