Examkin

Question

Difficulty: Very hardWeb Browser Security and Pop-Up/Redirect Troubleshooting

A tier-2 help desk technician is investigating an enterprise Windows 11 workstation where all installed web browsers (Edge and Chrome) continuously redirect users to an unauthorized site asking for corporate domain credentials when accessing internal or external web applications. The technician observed the following diagnostic details:

- Resetting browser settings, clearing cache/cookies, and starting browsers in safe mode with extensions disabled failed to resolve the issue.
- Automated antivirus and malware scans completed with zero infections detected.
- Standard `ping` requests to domain names resolve to incorrect public IP addresses, even though `ipconfig /all` displays valid corporate internal DNS server IP addresses.
- Running `nslookup company.com` uses the default corporate server and returns the legitimate internal IP address, but browsing directly to `https://company.com` still redirects to the rogue website.

Which of the following root causes is most likely responsible for overriding standard DNS resolution and causing the web browser redirections?

  1. Unauthorized static mapping entries configured inside the local operating system hosts fileAnswer
  2. B
    Stale authentication web tokens stored within the Windows Credential Manager Control Panel applet
  3. C
    An misconfigured pop-up blocker exception list permitting cross-site scripting redirects
  4. D
    An active watering hole attack leveraging corrupted browser certificate authority trust stores

Answer

Unauthorized static mapping entries configured inside the local operating system hosts file
The correct answer identifies unauthorized static mapping entries in the local operating system hosts file (`C:\Windows\System32\drivers\etc\hosts`). Windows evaluates the local `hosts` file prior to sending a query to configured DNS servers. In contrast, the command-line utility `nslookup` directly queries the DNS server, bypassing the local `hosts` file entirely. When `nslookup` yields correct IP addresses while browsers and `ping` commands resolve to malicious IP addresses, it indicates that static entries in the `hosts` file are intercepting and redirecting host name resolution.

Step-by-Step Solution

1
Analyze name resolution behavior differences between browser requests/ping and `nslookup`.
Identified that `ping` and web browsers use the standard Windows Name Resolution order (which checks the local `hosts` file before querying DNS), whereas `nslookup` queries the configured DNS server directly by design.
When `nslookup` returns the correct IP but browsers resolve to a rogue IP, the discrepancy points to a local override mechanism that precedes DNS server resolution in the OS lookup stack.
2
Evaluate local system components capable of overriding DNS name resolution.
The Windows `hosts` file located at `C:\Windows\System32\drivers\etc\hosts` maps hostnames directly to IP addresses and is evaluated before network DNS queries.
Malware or unauthorized scripts frequently modify the `hosts` file to redirect web requests away from legitimate servers to attacker-controlled IP addresses.
3
Formulate remediation steps.
Inspect and clean the `hosts` file by removing unauthorized static IP-to-hostname mappings.
Clearing malicious lines from the `hosts` file restores standard DNS lookup ordering and stops browser redirects.

Key Concept

Browser Redirect Troubleshooting and Windows Name Resolution Hierarchy
Rate this question

Topics

Web Browser Security and Pop-Up/Redirect Troubleshooting

More questions from this topic