While I was logged in to a VPN using Pulse Secure, I decided to make some edits to my /etc/hosts file. (The edits were unrelated to the Pulse secure address.) When I disconnected from Pulse, it overwrote the ENTIRE /etc/hosts file, discarding my changes. This is very easy to preproduce.
The app should not overwrite the entire file. It should re-read /etc/hosts and then modify ONLY the text that the app itself inserted, i.e. between the BEGIN/END tags that the app inserted.
FWIW, I'm using Pulse Secure 5.2.5 (897), on MacOS 10.12.6
As @zanyterp mentioned, Pulse Client will restore the hosts.bak (backup file; took before VPN connection) with the original one which will cause custom modified data to be overwritten.