At a government agency, the resolver returns an address for a critical name that the authoritative server does not publish, and users are sent to an unexpected host. Which conclusion fits that evidence?
Select an answer to reveal the explanation.
Short Explanation
When the sign on the door and the sign out on the highway disagree, you do not widen the highway. You treat a resolver answer that the authoritative server does not publish as a DNS hijack or cache-poisoning symptom. Buying bandwidth, retuning QoS, or replacing the laptop leaves the bad answer in place.
Full Explanation
Name resolution is wrong when the resolver hands out an address the authoritative server does not publish for that name. Users then connect to an unexpected host, which is the symptom of DNS hijacking or of a poisoned cache, not of a slow circuit. Increasing WAN bandwidth treats a lookup that returned the wrong host as if the problem were capacity, and extra capacity does not correct the record users receive. Retuning QoS so DNS sits in a higher class can change how quickly a query is forwarded, and it does not change the address in the answer. Replacing the laptop that received the unexpected address blames one client for a response the resolver issued; the next device that asks the same resolver can be sent to the same host. Exam caveat: a sanctioned split view can also differ from a public authoritative answer, so compare the resolver with the view it is supposed to serve before you close the case. Operational check: query the authoritative server and the agency resolver for the same name from a trusted point, and confirm they agree again after the resolver is cleaned. Until those answers match, capacity and client swaps are the wrong work.