Exam SY0-601 topic 1 question 651 discussion

In DNS poisoning, the attacker changes the DNS records for a legitimate website to point to a malicious website. This can be done by exploiting a vulnerability in the DNS server or by sending a spoofed DNS request. When the victim tries to access the legitimate website, they are redirected to the malicious website instead. The malicious website can then collect the victim's username and password, or it can install malware on the victim's computer. In this case, the change in the IP address for the vendor website is a clue that DNS poisoning was used. The attacker changed the IP address to point to a malicious website, which is where the usernames and passwords were stolen.

Option elimination always work when you don't know right answer

DNS poisoning is a type of attack where the DNS (Domain Name System) records are manipulated to redirect traffic from legitimate websites to malicious ones. However, the scenario provided mentions a change in the IP address for a vendor website, which suggests that the change was observed at the network layer rather than the DNS layer. ANSWER MITM

DNS poisoning