IPA IP 2021 Question 56
A question IPA Japan published in 令和3年度 ITパスポート試験 公開問題 問56, translated into English. ITPEC is based on the same exams.
Which of the following is an attack that leads users to a fake site by overwriting the management information stored on a server that provides the service of matching domain names with IP addresses on the Internet?
Explanation
DNS cache poisoning — a forged entry is planted in a DNS server's cache, so a domain name resolves to the attacker's address.
A DNS server answers which IP address belongs to a domain name, and a caching DNS server keeps the answers it has looked up so that it can reuse them. In DNS cache poisoning the attacker gets a forged answer accepted into that cache, for example by sending a fake response before the genuine one arrives. Until the entry expires, every user who asks that server for the domain gets the attacker's IP address and is led to the fake site, even though they typed the correct URL.
Answer (b)
Why not others:
- •(a) DDoS attack — floods a server from many machines to stop its service; it does not rewrite any information
- •(c) SQL injection — slips SQL into an application's input to read or change its database, not the name-to-address data of a DNS server
- •(d) Phishing — lures users to a fake site with a disguised e-mail or link; the DNS server is not touched
Key rule: Rewriting the name-to-address data that a DNS server holds is DNS cache poisoning; luring users with a deceptive message is phishing.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.