At a digital marketing firm in Atlanta, Georgia, employees began reporting that access to a...

The correct answer is DNS Cache Poisoning. CEH network security material explains that cache poisoning occurs when a DNS server is tricked into storing fraudulent name-to-IP mappings in its cache. Once the poisoned entry is cached, many users querying that DNS service receive the same false resolution until the cache is flushed, expires, or the service is restarted. That maps directly to the scenario: multiple internal clients receive the same incorrect IP address for a legitimate domain, and the issue disappears after the organization’s name resolution service is restarted. Intranet DNS spoofing typically involves local interception and very fast forged replies on a LAN, while proxy server DNS poisoning changes browser-side proxy behavior, and internet DNS spoofing usually involves altering a host’s DNS configuration or redirecting it to a malicious resolver. The persistence across many users and the recovery after DNS service restart are the most important clues, because they indicate poisoned cached records on the resolver itself rather than isolated endpoint tampering. CEH guidance highlights that DNS cache poisoning can silently redirect users to counterfeit systems while appearing to resolve legitimate domain names normally.