200-201 Network Intrusion Analysis Practice Question
During an investigation, an analyst observes that a workstation resolves an internal hostname to an IP address that does not match the DHCP lease record, and subsequent SMB connections to that hostname reach an attacker-controlled server. Which attack technique best explains this behavior?
⚠ Common exam trap
The trap here is blaming layer 2 attacks like ARP poisoning for what is actually a name resolution manipulation at the DNS layer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DNS spoofing or rogue DNS response injection
A hostname resolving to an IP that contradicts the DHCP lease, followed by SMB traffic reaching an attacker server, points to manipulation of name resolution. DNS spoofing or rogue DNS responses inject false records so the client connects to the wrong endpoint. ARP poisoning operates at layer 2 with MAC mappings, DHCP starvation prevents lease acquisition, and SMB signing affects message integrity, so none of those explain the poisoned resolution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SMB signing downgrade on the file server
Why it's wrong here
SMB signing downgrade affects integrity verification of SMB messages between client and server; it does not alter DNS resolution results. The observed mismatch between the DHCP lease and the resolved IP occurs before any SMB session is established, so signing behavior cannot cause it. This option misattributes a name resolution problem to an SMB protocol security setting.
- ✗
DHCP starvation exhausting the address pool
Why it's wrong here
DHCP starvation consumes available leases so legitimate clients cannot obtain addresses, causing connectivity failures. It does not change how an already-leased host resolves a hostname to a different IP. The workstation here has a valid lease but receives a conflicting resolution, so DHCP pool exhaustion does not fit the evidence and would produce different symptoms such as failed address acquisition.
- ✓
DNS spoofing or rogue DNS response injection
Why this is correct
When a hostname resolves to an IP inconsistent with the DHCP lease and SMB traffic then reaches an attacker server, the name resolution itself has been manipulated. DNS spoofing or rogue responses inject false A records so clients connect to the attacker. This directly accounts for the mismatched resolution and the redirected SMB sessions, making it the best explanation for the observed behavior.
- ✗
ARP cache poisoning on the local subnet
Why it's wrong here
ARP poisoning maps an IP address to an attacker MAC within the local subnet, affecting layer 2 reachability. Here the hostname resolves to a different IP than the DHCP lease, which is a name resolution issue, not a MAC-to-IP mismatch. The SMB connections follow the poisoned name resolution, so ARP poisoning does not explain the observed hostname-to-IP discrepancy.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.