CEH Practice Question: Malware, Social Engineering and Network Attacks

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  High volume of DNS queries from a single source

  Why it's wrong here

  A high volume of DNS queries originating from a single source typically indicates a DNS amplification attack, where an attacker leverages open DNS resolvers to flood a target with large responses. This differs fundamentally from DNS spoofing, which focuses on manipulating the resolution process to provide incorrect IP addresses, rather than generating excessive query traffic from a specific origin. While both involve DNS, their attack vectors and immediate objectives are distinct.

• ✗

  ARP cache entries show unexpected MAC-IP mappings

  Why it's wrong here

  Unexpected MAC-IP mappings within ARP cache entries are a clear indicator of ARP poisoning, where an attacker associates their own MAC address with another device's IP address on a local network. This attack primarily targets the data link layer to intercept or modify local traffic. DNS spoofing, in contrast, operates at the application layer, manipulating domain name resolution to redirect users to malicious IP addresses, without directly altering ARP tables.

• ✗

  The switch's CAM table is full

  Why it's wrong here

  A switch's Content Addressable Memory (CAM) table becoming full is a direct symptom of a MAC flooding attack. This occurs when an attacker bombards the switch with a multitude of spoofed MAC addresses, exhausting its memory and forcing it to broadcast all subsequent traffic to every port. This network layer attack is entirely unrelated to DNS spoofing, which specifically targets the Domain Name System to provide fraudulent IP addresses for domain names.

• ✓

  The resolved IP address for a domain does not match the legitimate server

  Why this is correct

  When the IP address returned by a DNS query for a specific domain name differs from the legitimate server's actual IP, it is a primary indicator of DNS spoofing. An attacker has successfully intercepted or poisoned the DNS resolution process, substituting the correct IP with a malicious one. This manipulation ensures that subsequent client connections intended for the legitimate domain are instead directed to the attacker-controlled host.

• ✓

  Users are redirected to a malicious website despite typing the correct URL

  Why this is correct

  Users being redirected to an unintended or malicious website, even after accurately typing the correct URL, is a direct and observable symptom of successful DNS spoofing. This occurs because the compromised DNS resolution process provides the client with the attacker's IP address instead of the legitimate server's. Consequently, the client's web browser connects to the malicious server, displaying its content, despite the user's correct input.

Go deeper

Related to this question