Which tool, described as a DNS poisoning utility, helps spoof DNS query packets for a target IP address or group of hosts?

• A. Follow TCP Stream in Wireshark
• B. DerpNSpoof
• C. DNS cache poisoning
• D. DNS spoofing

Answer: (B)

This question tests understanding of a tool designed to manipulate DNS responses. DerpNSpoof is a DNS poisoning utility that crafts forged DNS reply packets and sends them to a target IP address or a group of hosts, with the goal of influencing what the target resolves a domain to. In practice, it can inject these forged responses to override legitimate answers, effectively redirecting traffic to an attacker-controlled address. That exactly matches the description of a tool that helps spoof DNS query packets for a target.

The other options don’t fit as well. Follow TCP Stream in Wireshark is used to reconstruct and analyze a TCP conversation, not to poison or spoof DNS responses. DNS cache poisoning describes the outcome or technique of corrupting DNS records rather than a specific tool. DNS spoofing refers to the broader technique of presenting false DNS responses, not a particular utility named for this purpose.