Chapter 46 · Quiz

DNS Attacks Quiz

6 multiple-choice questions and a matching section. Submit to reveal answers and explanations.

Question 1 of 6

What is the critical security property of the host file that makes it a viable DNS poisoning attack vector?

A. The host file is automatically synchronized across all devices on a network, allowing one modification to affect all systems B. The host file takes precedence over DNS queries — if an entry exists for a domain in the host file, the system uses it immediately without ever contacting the DNS server C. The host file is encrypted by default, making it invisible to antivirus software D. The host file can only be modified by network administrators, making changes difficult to trace

Question 2 of 6

Which DNS poisoning technique requires the attacker to intercept traffic in real-time and is specifically classified as an on-path attack?

A. Modifying the DNS server records directly after obtaining admin credentials B. Altering the client's host file using malware with elevated privileges C. Sending a forged DNS response to intercept and redirect a legitimate DNS query before the real server's answer arrives D. Gaining control of the domain registrar account to change DNS records

Question 3 of 6

On October 22, 2016, attackers changed domain registrations for 36 domains belonging to a Brazilian bank, redirecting all customer traffic for six hours without compromising any bank server. What type of attack does this represent, and what single control would have been most effective in preventing it?

A. Domain hijacking — MFA on the registrar account would have required a second factor beyond the stolen password, likely preventing the takeover B. DNS server modification — DNSSEC would have validated the authenticity of DNS responses and rejected the fraudulent ones C. On-path attack — network segmentation between the DNS infrastructure and customer-facing systems would have contained the impact D. Host file modification — endpoint protection on all customer devices would have detected and prevented the host file changes

Question 4 of 6

An attacker registers "bankofwesternusa.net" — a domain that differs from the legitimate "bankofwesternusa.com" only in the top-level domain. They deploy a pixel-perfect replica of the bank's login page. Customers who type ".net" instead of ".com" land on the fake page and submit their credentials. What attack technique is this?

A. DNS server modification — the attacker changed the bank's DNS record to point to their server B. Typosquatting / URL hijacking using an alternative TLD — the attacker registered a domain the victim might accidentally use; no DNS infrastructure was compromised C. On-path DNS attack — the attacker intercepted DNS queries and returned the .net domain's IP in response D. Domain hijacking — the attacker gained access to the bank's registrar account and modified DNS records

Question 5 of 6

DNSSEC is implemented across an organization's DNS infrastructure. Which of the following DNS attack vectors does DNSSEC directly mitigate, and which does it NOT address?

A. DNSSEC prevents all three DNS poisoning vectors and also protects against domain hijacking and typosquatting B. DNSSEC prevents domain hijacking because it requires the registrar to validate signatures before allowing DNS changes C. DNSSEC directly mitigates forged DNS responses (on-path attacks) by cryptographically validating responses, but does NOT protect against host file modification, direct DNS server compromise, domain hijacking at the registrar, or typosquatting D. DNSSEC is ineffective against all DNS attacks because attackers simply use HTTP instead of HTTPS to bypass signature validation

Question 6 of 6

A security analyst reports that a domain "officialcompany.org" has been registered by an unknown party and is displaying advertisements for products unrelated to the company. The company's actual domain is "officialcompany.com". Which URL hijacking motivation BEST describes this scenario?

A. Phishing — the attacker is harvesting credentials from visitors who believe they are on the company's site B. Advertising revenue — misdirected visitors generate click revenue for the typosquatter through ad impressions or affiliate links C. Competitor redirection — visitors are being sent to a competing company's website D. Malware distribution — the advertisements are delivering drive-by download exploits

Matching — DNS Attack Concepts

Match each term on the left to its correct description on the right.

1. DNS Poisoning

2. Domain Hijacking

3. Typosquatting

4. Host File

A. A local system file that is consulted before DNS servers and whose entries take precedence over external DNS responses

B. Gaining access to a domain registrar account to change DNS records and redirect traffic without touching any actual server

C. Corrupting DNS data — whether on a server, in a local file, or via forged responses — to redirect users to malicious destinations

D. Registering misspelled or slightly altered domain names to capture traffic from users who make typing errors or TLD assumptions

1 → 2 → 3 → 4 →