Question 110
When A resolver searches external DNS before local /etc/hosts and ignores a deliberate test alias, which risk requires the most immediate attention?
Explanation
Correct Answer
The most direct risk is Assuming a hosts-file edit always wins can break local overrides. A suitable corrective step is Inspect /etc/nsswitch.conf host lookup order and validate getent hosts, then verify getent returns the expected test alias from the intended source.
Incorrect Answers
It is not the most direct failure mode. The relevant mechanism is NSS controls whether files or DNS are consulted first for hostnames, which risks Assuming a hosts-file edit always wins can break local overrides.
That outcome fits another condition, A system using systemd-resolved shows generated /etc/resolv.conf and an administrator edits it persistently, rather than the current one.
That outcome fits another condition, A firewall rule permits port 53 only over TCP and small DNS queries work intermittently, rather than the current one.