Users on the corporate network report that their bank's domain resolves to an unfamiliar IP address. The same name resolves correctly from public resolvers and other networks, local hosts files are clean, and the internal resolver's cache holds the bogus record with an unusually long TTL. Which attack is indicated?
Select an answer to reveal the explanation.
Short Explanation
Think of the internal resolver as the office phone directory -- somebody slipped a fake number into it, so everybody who looks up the bank calls the crook. Outside resolvers have the right number, so the problem lives in your cache. That long TTL is the attacker trying to make the lie stick around.
Full Explanation
DNS cache poisoning inserts a forged record into a resolver's cache so that clients querying that resolver receive an attacker-controlled address. Because resolvers answer from cache until the record's time to live expires, a poisoned entry with a long TTL keeps misdirecting every user who relies on that resolver. The scenario isolates the fault precisely: public resolvers return the correct address, local hosts files are clean and the internal resolver holds the bogus record, so the corruption exists in that resolver's cache. Domain hijacking at the registrar changes the authoritative records or ownership of the domain itself, which would cause public resolvers and other networks to receive the wrong answer as well. ARP spoofing redirects traffic at the link layer by falsifying MAC address mappings; it does not place a false record in the DNS cache. Typosquatting relies on users visiting a misspelled look-alike domain, whereas these users entered the correct domain and still received the wrong address. Exam caveat: DNS Security Extensions validate signed responses and help resolvers reject forged records. Operational check: flush the poisoned record from the resolver cache, verify the correct address against the authoritative servers, review resolver logs for unusual response patterns, and enable DNSSEC validation on the resolver.