ITPEC FE Subject A October 2025 Question 29
The IP address of server X that is owned by an attacker, is recorded on Company B’s DNS cache server as the IP address corresponding to the FQDN of Company A’s web server. As a result, which of the following are the users that unintentionally connect to server X? Here, the employees of Company A and Company B use their own company’s DNS cache server for name resolution.
Explanation
Company B employees who try to reach Company A's web server — DNS cache poisoning misleads only the users of the poisoned server, and only for the forged name.
The forged record sits in Company B's DNS cache server and maps Company A's web server FQDN to server X. Two conditions must both hold for a user to be misled:
- •the user resolves names through Company B's DNS cache server, so is a Company B employee, and
- •the user looks up the forged name, Company A's web server.
Answer (c)
Why not others:
- •(a) and (b) — Company A employees use Company A's own DNS cache server, which holds no forged record, whichever server they visit.
- •(d) — Company B's employees do use the poisoned cache, but the record for Company B's own web server was not changed, so they get its correct address.
Key rule: A poisoned DNS cache affects the clients that use that cache, and only for the names whose records were forged.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.