Examkin

Question

Difficulty: HardWeb Browser Security and Pop-Up/Redirect Troubleshooting

A network administrator is troubleshooting an issue on an enterprise Windows 11 workstation. The user reports that entering legitimate internal domain names into any installed web browser (Microsoft Edge, Google Chrome, or Mozilla Firefox) immediately routes them to an unfamiliar external site requesting account credentials. An initial inspection confirms there are no rogue browser extensions installed, system proxy settings are configured to automatically detect settings, and flushing the local DNS cache did not resolve the issue. Which of the following is the NEXT best troubleshooting step to identify the cause of the redirection?

  1. Inspect the Windows hosts file for malicious static IP mapping entries.Answer
  2. B
    Open Internet Options in Control Panel and restore default security settings on the Advanced tab.
  3. C
    Clear the browser cache, cookies, and temporary internet files across all installed browsers.
  4. D
    Re-enable the browser pop-up blocker and revoke web notification permissions for unknown domains.

Answer

Inspect the local Windows hosts file for malicious static IP mapping entries.
Inspecting the local Windows hosts file is the best NEXT step because the OS checks this local text file for domain-to-IP mappings prior to sending external DNS requests. Malicious software often inserts lines mapping legitimate website names to malicious IP addresses, causing consistent redirections across all web browsers installed on the machine.

Step-by-Step Solution

1
Analyze symptoms across multiple web browsers
The issue affects all installed browsers (Edge, Chrome, Firefox) equally, indicating a system-level configuration or network resolution override rather than an isolated browser extension or profile issue.
Rogue extensions typically affect only the specific browser in which they are installed.
2
Evaluate local system resolution files
Check the C:\Windows\System32\drivers\etc\hosts file to see if malicious entries map legitimate corporate domain names to external rogue IP addresses.
The Windows operating system evaluates the local hosts file before sending DNS queries to configured name servers.
3
Differentiate hosts file redirection from proxy or pop-up issues
Because proxy settings are already verified clean and DNS flushing failed, static IP mappings in the hosts file remain the primary vector causing cross-browser domain hijacking.
Modifying the hosts file allows malware to redirect specific domain queries without triggering browser proxy alerts.

Key Concept

System-Level Browser Hijacking and Hosts File Troubleshooting
Rate this question

Topics

Web Browser Security and Pop-Up/Redirect Troubleshooting

More questions from this topic