What is the first step for a hacker conducting a DNS cache poisoning (DNS spoofing) attack against an organization?

A. The attacker queries a nameserver using the DNS resolver.
B. The attacker uses TCP to poison the DNS resolver.
C. The attacker makes a request to the DNS resolver.
D. The attacker forges a reply from the DNS resolver.