The scenario describes a classic case of DNS poisoning. The core evidence is that the website appears defaced only to external users, while it remains normal for internal users. Furthermore, a file integrity check using Tripwire confirms the web server's files have not been altered. This rules out a direct compromise of the server. DNS poisoning involves an attacker corrupting the records of a public DNS server (like the one used by the ISP). This causes the domain name www.masonins.com to resolve to the IP address of an attacker-controlled server for anyone using that poisoned DNS server. Internal users, likely using a separate and uncompromised internal DNS server, resolve the domain to the correct IP, hence seeing the intact site.

A. ARP spoofing: This is a Layer 2 attack confined to a local area network (LAN) and cannot affect external users accessing the site over the internet.
B. SQL injection: This attack would modify content on the web server's database, but the Tripwire scan confirmed that all server content was intact.
D. Routing table injection: While this could misdirect traffic, DNS poisoning is a more direct and common method for targeting a specific domain name as described, and it perfectly explains the name resolution discrepancy.

1. National Institute of Standards and Technology (NIST) Special Publication 800-81-2, Secure Domain Name System (DNS) Deployment Guide. Section 2.2, "DNS Threats," describes cache poisoning: "In this attack, an attacker sends false information to a DNS resolver to have it stored for subsequent queries... the attacker can cause users of the resolver to be directed to a different system than the one they were trying to reach." This directly matches the scenario where external users are redirected.

2. Kurose, J. F., & Ross, K. W. (2017). Computer Networking: A Top-Down Approach (7th ed.). Pearson. This standard university textbook explains in Chapter 2, Section 2.5, "The Domain Name System," that DNS poisoning allows an attacker to "insert a bogus resource record... into a DNS server." This causes the server to cache the incorrect mapping, redirecting subsequent user requests for a legitimate hostname to a malicious IP address.

3. Tanenbaum, A. S., & Wetherall, D. J. (2011). Computer Networks (5th ed.). Prentice Hall. In Chapter 7, Section 7.2.4, "DNS—The Domain Name System," the text discusses DNS security and the threat of "DNS spoofing," where an attacker forges a reply to a DNS query. This can "poison the cache" of a resolver, causing it to return a fraudulent IP address to clients, which is precisely what happened to the external users in the scenario.