Information Technology Specialist (ITS) Cybersecurity Practice Exam

In a DNS hijacking attack, what do threat actors change to point to a predetermined address?

1. The MX record

2. The A record

3. The TXT record

4. The CNAME record

The correct answer is: The A record

In a DNS hijacking attack, threat actors typically target the A record, which maps a domain name to the IP address of the server hosting the website. By altering the A record, attackers can redirect users trying to access a legitimate website to a malicious site of their choosing. This can enable various forms of fraud, such as phishing attacks, where users are led to believe they are on a trusted site, or other malicious activities. While the MX record relates to mail exchange servers and is important for routing email, it is not the primary target for redirection in a DNS hijacking scenario. Similarly, the TXT record is often used to hold text information associated with a domain, but again, it does not facilitate direct access to websites. The CNAME record, which allows one domain to be an alias for another, could theoretically be manipulated in a hijacking scenario, but it typically does not have the same direct impact as changing the A record when it comes to redirecting traffic to a predetermined address. Thus, the focus on the A record is what makes it the most relevant choice in the context of a DNS hijacking attack.