Free Security+ practice test 2026: the full 90-question Mock Test 1

Sample question

Employees on one floor who browse to payroll.corp.example land on a look-alike portal, while employees on other floors, who use a different resolver, reach the real site. When an administrator queries the floor’s assigned internal resolver from its own console, it returns 192.0.2.44, but the zone’s authoritative server returns 10.20.1.15. Which of the following is MOST likely occurring?

• A Option A: Domain hijackingYour answer Incorrect Taking over the domain at the registrar would change the answer every resolver receives, yet employees on other floors reach the real site and the zone’s authoritative server still returns the correct address.
• B Option B: ARP cache poisoningYour answer Incorrect ARP poisoning on the floor could let an attacker intercept lookups and forge replies in transit, but the resolver returns the wrong address even when queried from its own console, so the bad answer is stored on the resolver rather than injected on the wire.
• C Option C: DNS cache poisoningYour answer Correct answer The affected floor’s resolver returns the wrong address even when queried on the server itself, while the authoritative server and the other floors’ resolver give the right one, so a forged record has been planted in that resolver’s cache.
• D Option D: Rogue DHCP serverYour answer Incorrect A rogue DHCP server would point clients at an attacker-controlled resolver, but here the floor’s assigned internal resolver is itself returning the wrong address, so clients are not being sent to a different server.