N10-009 Network Security Practice Question
A security analyst detects a large number of DNS queries for the same domain from multiple internal hosts. The responses contain large payloads. Which type of attack is likely occurring?
⚠ Common exam trap
CompTIA often tests the distinction between DNS amplification and DNS cache poisoning by describing 'large payloads' and 'many hosts' — the trap is that candidates confuse the reflection/amplification mechanism with the cache corruption of poisoning, but amplification focuses on traffic volume, not record integrity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DNS amplification
DNS amplification is a type of reflection-based DDoS attack where an attacker sends a small query (e.g., ANY or DNSSEC-signed record request) with a spoofed source IP (the victim's address) to an open DNS resolver. The resolver responds with a large payload (often 50–100x larger than the query), flooding the victim's network. The scenario describes many internal hosts making queries to the same domain and receiving large responses, which matches the amplification effect from a compromised or misconfigured internal resolver.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DNS cache poisoning
Why it's wrong here
DNS cache poisoning, also known as DNS spoofing, is an attack where an attacker injects fraudulent DNS records into a DNS resolver's cache. This manipulation causes the resolver to return incorrect IP addresses for legitimate domain queries, redirecting users to malicious websites or servers controlled by the attacker. The objective is misdirection and deception, not to overwhelm a target with a high volume of traffic.
When this WOULD be correct
A question describing a scenario where users are redirected to a malicious site after a DNS resolver returns incorrect IP addresses, with no mention of large response sizes or multiple internal hosts, would make cache poisoning correct.
- ✓
DNS amplification
Why this is correct
DNS amplification is a type of Distributed Denial-of-Service (DDoS) attack where attackers leverage vulnerable open DNS resolvers to flood a target with an overwhelming volume of traffic. The attacker spoofs the victim's IP address as the source for small DNS queries sent to numerous open resolvers. These resolvers then send much larger DNS responses back to the spoofed victim, effectively multiplying the attack's bandwidth and overwhelming the target's network capacity.
- ✗
DNS tunneling
Why it's wrong here
DNS tunneling involves encoding data of other protocols, such as SSH or HTTP, within DNS queries and responses to bypass firewalls or exfiltrate data covertly. This technique establishes a hidden communication channel, often for command-and-control or data theft, rather than generating a large volume of traffic intended to overwhelm a network or server. Its primary goal is stealth and circumvention, not denial of service through traffic amplification.
When this WOULD be correct
A question describing a single host sending many DNS queries to exfiltrate data or establish a command-and-control channel, where the DNS responses contain encoded data, would make DNS tunneling the correct answer.
- ✗
DNS zone transfer
Why it's wrong here
A DNS zone transfer is a legitimate process used to replicate DNS zone files from a primary DNS server to secondary servers, ensuring redundancy and load distribution for domain resolution. While misconfigured zone transfers can inadvertently expose sensitive network information, the process itself is a standard operational function for maintaining DNS infrastructure. It does not involve generating an excessive volume of queries to launch a denial-of-service attack against a target.
When this WOULD be correct
A question describing an unauthorized attempt to copy the entire DNS zone file from a DNS server to an external host, often using AXFR requests, would make DNS zone transfer the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓DNS amplificationCorrect answer▾
Why this is correct
DNS amplification is a type of Distributed Denial-of-Service (DDoS) attack where attackers leverage vulnerable open DNS resolvers to flood a target with an overwhelming volume of traffic. The attacker spoofs the victim's IP address as the source for small DNS queries sent to numerous open resolvers. These resolvers then send much larger DNS responses back to the spoofed victim, effectively multiplying the attack's bandwidth and overwhelming the target's network capacity.
✗DNS cache poisoningWrong answer — click to see why▾
Why this is wrong here
DNS cache poisoning involves corrupting the resolver's cache with false records, not causing large responses to many queries from internal hosts. The large payloads indicate amplification, not cache manipulation.
★ When this WOULD be the correct answer
A question describing a scenario where users are redirected to a malicious site after a DNS resolver returns incorrect IP addresses, with no mention of large response sizes or multiple internal hosts, would make cache poisoning correct.
Why candidates choose this
Candidates may confuse any DNS-based attack with cache poisoning, especially if they recall it as a common threat, without recognizing the specific indicator of large response payloads characteristic of amplification.
✗DNS tunnelingWrong answer — click to see why▾
Why this is wrong here
DNS tunneling typically involves encoding data in DNS queries or responses for covert communication, not large payloads from many hosts querying the same domain. The scenario describes many hosts querying the same domain with large responses, which is characteristic of amplification, not tunneling.
★ When this WOULD be the correct answer
A question describing a single host sending many DNS queries to exfiltrate data or establish a command-and-control channel, where the DNS responses contain encoded data, would make DNS tunneling the correct answer.
Why candidates choose this
Candidates may confuse the large payloads in DNS responses with data exfiltration or covert channels, leading them to think of tunneling instead of the amplification attack's reflection and amplification characteristics.
✗DNS zone transferWrong answer — click to see why▾
Why this is wrong here
DNS zone transfer is a mechanism for replicating DNS databases between servers, not an attack that generates many queries with large payloads from internal hosts.
★ When this WOULD be the correct answer
A question describing an unauthorized attempt to copy the entire DNS zone file from a DNS server to an external host, often using AXFR requests, would make DNS zone transfer the correct answer.
Why candidates choose this
Candidates may confuse the term 'zone transfer' with any large-scale DNS data movement, or mistakenly think that large payloads imply data exfiltration via zone transfers.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Common DNS Record Types
| Record | Purpose | Example |
|---|---|---|
| A | IPv4 address mapping | example.com → 93.184.216.34 |
| AAAA | IPv6 address mapping | example.com → 2606:2800::1 |
| CNAME | Alias to another hostname | www → example.com |
| MX | Mail server for domain | example.com → mail.example.com (priority 10) |
| TXT | Text data (SPF, DKIM, verification) | v=spf1 include:_spf.example.com ~all |
| NS | Authoritative name servers | example.com NS ns1.example.com |
| PTR | Reverse DNS (IP → hostname) | 34.216.184.93.in-addr.arpa → example.com |
| SOA | Zone authority record | Primary NS, admin email, serial, TTL defaults |
Go deeper
Related to this question
Learn chapter
Network Device Hardening
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
DNSSEC
DNSSEC adds cryptographic signatures to DNS records to ensure data authenticity and integrity, preventing cache poisoning and spoofing attacks.
About these practice questions
One of 464 original N10-009 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.