DNS poisoning in Computer Networks - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is DNS poisoning?

Which of the following best describes DNS poisoning?

A A method to speed up DNS queries by caching results locally.

B A process of updating DNS records to reflect new IP addresses.

C A technique to encrypt DNS requests for privacy.

D An attack that corrupts the DNS cache to redirect users to malicious sites.

💡 Hint

Think about what happens when DNS information is changed to mislead users.

DNS poisoning involves corrupting the DNS cache so that users are redirected to fake or harmful websites instead of the intended ones.

📋 Factual

intermediate

Common target of DNS poisoning attacks

Which part of the DNS system is most commonly targeted in DNS poisoning attacks?

A DNS resolver cache

B Authoritative DNS server database

C Root DNS servers

D Local hosts file on user computers

💡 Hint

Attackers often try to trick the system that answers queries for users quickly.

The DNS resolver cache stores recent DNS query results and is commonly targeted because poisoning it affects many users quickly.

🔍 Analysis

advanced

Impact of DNS poisoning on users

What is the most likely outcome for a user whose DNS cache has been poisoned?

A Their device will automatically update DNS settings to fix the issue.

B Their internet connection will be completely blocked.

C They will be redirected to fraudulent websites without knowing it.

D They will receive a warning message from their browser about DNS errors.

💡 Hint

Consider what happens when DNS points to wrong IP addresses.

When DNS cache is poisoned, users unknowingly visit fake websites that can steal information or spread malware.

❓ Comparison

advanced

Difference between DNS poisoning and DNS spoofing

Which statement correctly distinguishes DNS poisoning from DNS spoofing?

A DNS poisoning encrypts DNS data; DNS spoofing decrypts it.

B DNS poisoning corrupts cached DNS data; DNS spoofing involves sending fake DNS responses during a query.

C DNS poisoning happens only on servers; DNS spoofing happens only on clients.

D DNS poisoning is a defensive technique; DNS spoofing is an attack.

💡 Hint

Think about when the fake DNS information is introduced in each attack.

DNS poisoning changes stored DNS data to mislead future queries, while DNS spoofing sends fake DNS replies during a live query to trick the user immediately.

❓ Reasoning

expert

Why DNSSEC helps prevent DNS poisoning

How does DNSSEC help protect against DNS poisoning attacks?

A By digitally signing DNS data to verify its authenticity before use.

B By encrypting all DNS queries to hide them from attackers.

C By blocking all DNS requests from unknown IP addresses.

D By automatically clearing the DNS cache every minute.

💡 Hint

Consider how DNSSEC ensures the DNS data is trustworthy.

DNSSEC adds digital signatures to DNS data so that resolvers can check if the data is genuine and not tampered with, preventing poisoning.

Practice

1. What is the main goal of DNS poisoning in computer networks?

easy

A. To block access to certain websites

B. To redirect users to fake websites by giving wrong IP addresses

C. To encrypt DNS queries for security

D. To speed up the DNS lookup process

Solution

1. Step 1: Understand DNS function

   DNS translates website names into IP addresses so computers can find websites.

2. Step 2: Identify DNS poisoning effect

   DNS poisoning gives wrong IP addresses, sending users to fake sites instead of real ones.

3. Final Answer:

   To redirect users to fake websites by giving wrong IP addresses -> Option B

4. Quick Check:

   DNS poisoning = Redirect to fake sites [OK]

Hint: DNS poisoning tricks DNS to give wrong addresses [OK]

Common Mistakes:

• Thinking DNS poisoning speeds up browsing
• Confusing DNS poisoning with encryption
• Believing it blocks websites instead of redirecting

2. Which of the following is a correct way to describe DNS poisoning?

easy

A. It modifies DNS cache with false information

B. It encrypts DNS queries to protect privacy

C. It speeds up DNS resolution by caching

D. It blocks DNS requests from unknown sources

Solution

1. Step 1: Recall DNS poisoning mechanism

   DNS poisoning involves changing DNS cache entries to wrong IP addresses.

2. Step 2: Match description to options

   Only It modifies DNS cache with false information correctly states DNS poisoning modifies DNS cache with false info.

3. Final Answer:

   It modifies DNS cache with false information -> Option A

4. Quick Check:

   DNS poisoning = false DNS cache entries [OK]

Hint: DNS poisoning changes DNS cache to wrong info [OK]

Common Mistakes:

• Confusing poisoning with encryption
• Thinking it speeds up DNS
• Assuming it blocks requests

3. Consider this scenario: A user tries to visit example.com. Due to DNS poisoning, the DNS cache returns the IP 192.0.2.123 instead of the real IP 93.184.216.34. What is the likely result?

medium

A. The user is redirected to a fake website at IP 192.0.2.123

B. The DNS query fails and the website doesn't load

C. The user reaches the real example.com website safely

D. The user's browser automatically blocks the connection

Solution

1. Step 1: Understand DNS poisoning effect on IP

   The DNS cache gives a wrong IP (192.0.2.123) instead of the real one (93.184.216.34).

2. Step 2: Predict user experience

   The user is sent to the wrong IP, likely a fake website pretending to be example.com.

3. Final Answer:

   The user is redirected to a fake website at IP 192.0.2.123 -> Option A

4. Quick Check:

   Wrong IP from DNS = fake site visit [OK]

Hint: Wrong IP from DNS means fake site shown [OK]

Common Mistakes:

• Assuming user reaches real site
• Thinking DNS query fails
• Believing browser blocks automatically

4. A network admin notices users are being redirected to suspicious sites. They suspect DNS poisoning. Which action will help fix this issue?

medium

A. Turn off the internet connection temporarily

B. Disable the firewall to allow all traffic

C. Change all user passwords immediately

D. Clear the DNS cache on affected devices and servers

Solution

1. Step 1: Identify how DNS poisoning affects devices

   DNS poisoning corrupts DNS cache with wrong IP addresses causing redirection.

2. Step 2: Choose corrective action

   Clearing DNS cache removes false entries, restoring correct address resolution.

3. Final Answer:

   Clear the DNS cache on affected devices and servers -> Option D

4. Quick Check:

   Fix DNS poisoning by clearing DNS cache [OK]

Hint: Clear DNS cache to remove poisoned entries [OK]

Common Mistakes:

• Disabling firewall worsens security
• Changing passwords doesn't fix DNS
• Turning off internet is impractical

5. A company wants to protect its users from DNS poisoning attacks. Which combined approach is best to reduce risk?

hard

A. Manually edit hosts files on all user devices

B. Only use public Wi-Fi networks and disable firewalls

C. Use DNSSEC to verify DNS data and configure trusted DNS servers

D. Rely solely on antivirus software for protection

Solution

1. Step 1: Understand DNSSEC and trusted DNS servers

   DNSSEC adds digital signatures to DNS data to verify authenticity. Trusted DNS servers reduce risk of poisoning.

2. Step 2: Evaluate options for protection

   Use DNSSEC to verify DNS data and configure trusted DNS servers combines verification and trusted sources, effectively reducing DNS poisoning risk.

3. Final Answer:

   Use DNSSEC to verify DNS data and configure trusted DNS servers -> Option C

4. Quick Check:

   DNSSEC + trusted DNS = strong DNS poisoning defense [OK]

Hint: Use DNSSEC and trusted servers to stop poisoning [OK]

Common Mistakes:

• Thinking public Wi-Fi is safe
• Manually editing hosts is impractical
• Relying only on antivirus misses DNS attacks