Adns server on your client's network is receiving a large number of dns queries from what appears to be a workstation on their network. on closer examination, the workstation does not appear to be the source of the dns queries, but is receiving the responses from the dns server. what type of attack best matches this description

The answer is reflective DNS attack

Explanation:

Reflective DNS Attack is used in many distributed DDoS attacks to knock down an internet pipe. The attack is divided in two stages: first  the attacker sends lots of requests to one  or more legitimate DNS servers  while using spoofed source IP of the target person, and then, in the second stage, the DNS server receiving the semi-legitimate requests replies to the spoofed IP, thereby unknowingly lauching an attack on the target computer with responses to requests never sent by the victim.