Exam 220-1002 topic 1 question 433 discussion

Actual exam question from CompTIA's 220-1002

Question #: 433
Topic #: 1

A user is trying to access a popular email website but is being redirected to a different website that asks for login credentials. The user calls a technician, who promptly notices a security issue. Which of the following should the technician do to remove the threat from the system?

A. Remove all parameters after the FQDN website address.
B. Remove all files from the temporary folder and restart the computer.
C. Remove and reinstall the web browser in safe mode.
D. Remove all lines that are not comments from the hosts file.

Show Suggested Answer

Suggested Answer: B 🗳️

by JE39 at July 14, 2021, 10:07 p.m.

Comments

Submit Cancel

JE39

Highly Voted 3 years, 11 months ago

Redirections in the browser :- Entries within Host file or Proxy added to browser settings by malware. Solution check host files for entry, remove proxy setting and/or reset browser go default settings.

upvoted 13 times

...

AASA79

Highly Voted 3 years, 7 months ago

https://www.zdnet.com/article/how-to-use-a-hosts-file-to-improve-your-internet-experience/ A Hosts file is a file that almost all computers and operating systems can use to map a connection between an IP address and domain names. D. Remove all lines that are not comments from the hosts file. is the correct answer

upvoted 6 times

[Removed]

2 years, 9 months ago

My only doubt about that answer is that it suggests removing ALL host-file lines, including essential ones. It's definitely the right place to check, but you typically only remove identifiable malware-injected code on it. Eliminating that answer, B is the next most plausible one—even if it's unideal in a real-world backdrop.

upvoted 1 times

...

VasiliyFis

Most Recent 3 weeks, 2 days ago

Selected Answer: D

If a user is being redirected to a fake website (especially a fake login page), and this happens only on their machine, it's a classic symptom of a maliciously altered hosts file. The hosts file is used to manually map domain names to IP addresses before DNS is queried. Malware can use it to redirect known websites (e.g., email providers) to malicious IPs.

upvoted 1 times

...

alforg03

1 year, 4 months ago

D is the right answer. The hosts file maps IP addresses to hostnames -- some web browsers, such as Chrome, do not reference it when attempting to connect to a website, but some do.

upvoted 1 times

...

sage888888888123

2 years, 11 months ago

Purely based on what Ive seen from messer, dion, and a few questions from these test banks I'd go with D because most of the time when there is redirection question, the answer has to do with host files...

upvoted 4 times

...

DJGeorgeCostanza

3 years, 11 months ago

The hosts file maps IP addresses to hostnames -- some web browsers, such as Chrome, do not reference it when attempting to connect to a website, but some do. Can definitely see it being D as the answer.

upvoted 2 times

DJGeorgeCostanza

3 years, 11 months ago

On the other hand though, viruses do utilize the temporary folder and deleting the contents within the folder (not the folder itself) doesn't hurt at all and could potentially remove a virus that's hosting in that location. Gunna say B is a closer answer for "remove the threat from the system", because if the virus keeps writing data to the hosts file, even if you correct the data in that file, it'll just keep writing to the file until you remove the virus.

upvoted 4 times

...