Examkin

Soru

Zorluk: ZorWeb Browser Security and Pop-Up/Redirect Troubleshooting

During a security audit on a corporate Windows 11 desktop, an analyst observes that entering `payroll.internal` into any web browser redirects the user to a suspicious external landing page. Executing `nslookup payroll.internal` in the command prompt successfully returns the correct internal IP address (`10.0.4.25`). Additionally, browser inspection reveals no active extensions, proxy configurations, or custom DNS-over-HTTPS settings. Which of the following locations should the analyst inspect FIRST to locate the root cause of the redirection?

  1. The local operating system hosts fileCevap
  2. B
    The Internet Options Connections tab within Control Panel
  3. C
    The browser temporary web cache and session cookies
  4. D
    The Windows Defender Firewall inbound policy rules

Cevap

The local operating system hosts file
In Windows, standard network applications (such as web browsers) check the local `hosts` file before issuing DNS queries to remote servers. Conversely, command-line diagnostic tools like `nslookup` query DNS servers directly. Because `nslookup` resolved the domain name correctly while browsers redirected to an unwanted address—and because browser extensions and proxy settings were ruled out—the redirection is caused by a malicious or modified entry in the local `hosts` file (`C:\Windows\System32\drivers\etc\hosts`).

Adım Adım Çözüm

1
Analyze the discrepancy between nslookup and web browser behavior
Identify that nslookup bypasses local resolution files and queries DNS servers directly, whereas standard OS applications use local resolution order first.
Understanding the OS resolution order isolates whether the issue is network-wide DNS or local to the host.
2
Evaluate local name resolution mechanism precedence in Windows
Recognize that Windows checks the local `hosts` file (`C:\Windows\System32\drivers\etc\hosts`) before sending DNS request packets across the network interface.
A rogue entry mapping `payroll.internal` to an unauthorized IP address overrides normal DNS queries for browser applications.
3
Conclude the appropriate inspection location
Select the local operating system hosts file as the primary target for investigation.
Editing or resetting the hosts file will immediately remove the unauthorized domain redirect.

Anahtar Kavram

Windows Name Resolution Order and Hosts File Hijacking
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Web Browser Security and Pop-Up/Redirect Troubleshooting

Bu konudan daha fazla soru