SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
Users can reach the correct website name, but their browsers are redirected to a fake server after the local DNS cache is altered. What attack is most likely?
⚠ Common exam trap
It's easy for candidates to confuse DNS poisoning with a man-in-the-middle attack or think that altering the local hosts file is the same mechanism, but the question specifically states the local DNS cache is altered, which is the hallmark of DNS cache poisoning.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DNS poisoning
DNS poisoning (also known as DNS cache poisoning) occurs when an attacker inserts forged DNS resource records into the local DNS cache, causing subsequent queries for a legitimate domain to resolve to an attacker-controlled IP address. In this scenario, users type the correct website name, but because the local DNS cache has been altered, their browsers are redirected to a fake server. This directly matches the description of DNS poisoning.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
DNS poisoning
Why this is correct
DNS poisoning corrupts the mapping between a domain name and its IP address, typically by injecting forged responses into a DNS resolver's cache. In this attack, users type a legitimate URL, but the resolver returns an attacker-controlled IP address, so the browser displays the correct domain while silently navigating to a fake server. This matches the scenario exactly because the address bar appears unchanged while traffic is misrouted to a malicious destination.
- ✗
Denial of service
Why it's wrong here
A denial of service (DoS) attack aims to overwhelm a server or network resource with excessive traffic, making an online service unavailable to legitimate users. It does not alter DNS records or cause a browser to silently load a fraudulent website, since its goal is disruption rather than surreptitious redirection. Because users are still loading a page (albeit a fake one), the observed behavior contradicts a DoS explanation.
- ✗
Replay attack
Why it's wrong here
A replay attack involves intercepting an authenticated or valid data transmission and retransmitting it later to duplicate an unintended effect, such as replaying a signed login request. It operates at the application or session layer and requires no modification to DNS resolution. The attack would not cause a legitimate domain to resolve to a fake server; it only repeats data that was already sent, so it is inconsistent with the described redirection.
- ✗
Port scanning
Why it's wrong here
Port scanning is a reconnaissance technique used by attackers to identify open ports, running services, and potential vulnerabilities by sending crafted packets to a host and analyzing the responses. It is an information-gathering step that does not modify DNS records or redirect user traffic. While a scan may precede a subsequent attack, the observed symptom of an incorrect IP resolution for a known domain is unrelated to port scanning's function.
Visual reference
Go deeper
Related to this question
Learn chapter
Cryptojacking and Resource Abuse
Key term
DNS poisoning
DNS poisoning is a cyberattack that corrupts a DNS resolver's cache with false information, redirecting users to malicious websites without their knowledge.
Key term
DNS
DNS is the system that translates human-friendly domain names like example.com into machine-readable IP addresses so computers can find each other on a network.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.