Which local file can be edited to redirect DNS resolution to phishing sites?

• A. DNS cache
• B. Browser history
• C. Hosts file
• D. Firewall rules

Answer: (C)

Editing the hosts file lets you override how a domain name is resolved on the local machine. The OS checks this file for mappings before it asks any DNS servers, so you can redirect a domain to any IP you choose. That means a attacker-controlled entry can send a user trying to reach a legitimate site to a phishing server instead, by mapping the target domain to the attacker’s IP.

On Windows, the file is at C:\Windows\System32\drivers\etc\hosts; on Linux or macOS, it’s /etc/hosts. A typical edit would add a line with the malicious IP followed by the domain, for example: 203.0.113.45 phishing.example.com. With the mapping in place, DNS queries for that host are satisfied locally without contacting an external DNS server.

DNS cache, browser history, and firewall rules don’t provide a persistent, local-name-to-IP override the way the hosts file does, so they aren’t the mechanism used to directly redirect DNS resolution via a local file.