Demonstrate Familiarity with Malware Removal 100-160 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A malware analyst has identified a malicious DLL loaded by a legitimate application on a user's workstation. The DLL is not flagged by the antivirus because it is unsigned and new. The analyst needs to remove the malware while minimizing disruption to the user's work. What is the best course of action?

   • ADisable the legitimate application until the antivirus is updated
   • BQuarantine the DLL and then verify that the legitimate application still functions correctly
   • CDelete the DLL and reinstall the legitimate application immediately
   • DRestore the system from a backup taken before the infection
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security analyst needs to scan a Linux server for malware. The server is running critical services and cannot be taken offline. Which scanning approach is most appropriate?

   • ABoot the server from a rescue CD and run an offline scan.
   • BManually inspect all files for suspicious content.
   • CRun an on-access antivirus scanner that checks files as they are accessed.
   • DRun a full scan only during off-peak hours.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A user reports that their computer is infected with spyware that is capturing keystrokes. The IT admin has identified the spyware process and the associated files. What is the correct order of remediation steps?

   • ATerminate the process, quarantine the files, then rescan the system.
   • BQuarantine the files, then terminate the process, then reboot.
   • CReboot the system, then run a full scan, then delete the files.
   • DDelete the files, then rescan, then terminate the process.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A user's laptop is infected with spyware that is deeply integrated into the operating system. The administrator has tried multiple antivirus scans and manual removal, but the spyware reappears after reboot. The user has important files that are not backed up. What is the most effective remediation approach?

   • AContinue running antivirus scans until the spyware is removed
   • BBack up the user's files, then reimage the laptop and restore the files
   • CManually delete all spyware files and registry entries
   • DUse System Restore to roll back to a previous point
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   A scan log entry shows: 'Threat: Trojan.Win32.Emotet, Severity: High, File: C:\Users\Public\temp.exe, Action: Quarantined'. What does the 'Action: Quarantined' field indicate?

   • AThe file was allowed to run because it was a false positive
   • BThe file was permanently deleted from the system
   • CThe file was repaired by removing the malicious code
   • DThe file was moved to a secure, isolated location
   Reveal Solution Discussion Select an answer first