The correct option is DNS spoofing.

DNS spoofing is the practice of forging DNS responses so that a client or resolver receives false name to address mappings. DNSSEC mitigates this threat by cryptographically signing DNS records and establishing a chain of trust so resolvers can verify that responses are authentic and have not been tampered with.

Account compromise is incorrect because DNSSEC does not protect user credentials or prevent attackers from stealing accounts. That risk is addressed by authentication, access control, and credential protection measures rather than DNS record signing.

Eavesdropping on DNS traffic is incorrect because DNSSEC provides authenticity and integrity and not confidentiality. To prevent passive interception of DNS queries and responses you would use encrypted transports such as DNS over TLS or DNS over HTTPS.

Injection attacks is incorrect because DNSSEC is not intended to stop application level injection like SQL injection or cross site scripting. DNSSEC focuses specifically on ensuring DNS answers are genuine and unmodified.

Full AWS Practitioner Certification Question