GCFA Practice Question: Identification of Malicious and Normal Activity
An analyst reviewing a Windows workstation finds that the file C:\Windows\System32\drivers\etc\hosts has been modified and now contains several entries mapping well-known banking domains to 127.0.0.1. The file's LastWriteTime is two days ago, and no administrator has reported making the change. Which conclusion is MOST appropriate?
⚠ Common exam trap
The trap here is assuming any hosts-file edit is harmless user customization, when redirecting banking domains to loopback is a classic interception technique rather than ad-blocking.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The modification is consistent with host-file redirection used to block or intercept traffic to specific domains and warrants further investigation.
Redirecting well-known banking domains to 127.0.0.1 through the hosts file is a recognized adversary technique for intercepting or blocking traffic, and the unexplained, recent modification makes it more suspicious. The appropriate response is to investigate the change, identify the process or account responsible, and examine the host for related indicators rather than dismissing it as routine or user-initiated.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The modification indicates that the DNS Client service has been disabled on the host.
Why it's wrong here
Editing the hosts file does not disable the DNS Client service. The DNS Client service caches and resolves queries, and hosts-file entries are consulted before DNS regardless of whether that service is running. This option conflates two unrelated mechanisms and does not describe the observed artifact, so it is not a valid conclusion.
- ✓
The modification is consistent with host-file redirection used to block or intercept traffic to specific domains and warrants further investigation.
Why this is correct
The hosts file is a common target for malware that redirects known domains to loopback or to attacker infrastructure to intercept or block traffic. Mapping banking domains to 127.0.0.1 is a classic pattern that prevents the real site from loading while potentially enabling credential theft via a local listener. The unexplained modification and recent timestamp justify immediate investigation.
- ✗
The modification is benign because hosts-file changes are always performed by the user for ad-blocking purposes.
Why it's wrong here
While users do sometimes edit the hosts file for ad-blocking, the entries here target banking domains rather than advertising networks, which does not match a typical ad-blocking pattern. The absence of any user or administrator report and the recent timestamp further undermine the benign explanation. Assuming user intent without corroboration is not a sound forensic conclusion.
- ✗
The modification is a normal Windows update behavior and should be ignored.
Why it's wrong here
Windows updates do not add entries that redirect banking domains to the loopback address. Such mappings would break legitimate access and are consistent with adversary-controlled redirection. Treating this as routine update behavior would suppress a genuine indicator of compromise and leave the host's users exposed to credential theft or traffic interception.
About these practice questions
Courseiva writes every GCFA question from scratch — 292 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.