Demonstrate Familiarity with Malware Removal 100-160 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A scan log shows the following entry: 'Threat: Trojan.Win32.Emotet, Severity: High, File: C:\Users\jdoe\AppData\Local\Temp\svchost.exe, Action: Quarantine successful.' The administrator notices that the file path is in the user's Temp folder and the file name mimics a legitimate Windows process. What should the administrator do NEXT?

   • ARestore the file from quarantine because svchost.exe is a legitimate Windows process
   • BVerify that the quarantined file is no longer present and check for related registry entries or scheduled tasks
   • CReimage the entire workstation immediately
   • DDisable Windows Defender to prevent future false positives
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   After removing a keylogger from a user's workstation, the admin wants to ensure that the keylogger has not captured sensitive data that could be exfiltrated. Which post-remediation action is most important?

   • ACheck the firewall logs for outbound connections to unknown IPs.
   • BReset the user's passwords and enable multi-factor authentication.
   • CRun a full antivirus scan to confirm the keylogger is gone.
   • DReinstall the operating system to ensure no traces remain.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A scan log shows the following entry: 'Threat: Spyware.Agent, Severity: Medium, File: C:\Users\Public\AppData\Roaming\helper.dll, Action: Quarantined, Status: Deleted'. The analyst also sees that the file was associated with a process named 'helper.exe' that is no longer running. What should the analyst do next?

   • ARun a full system scan to verify that no related files or registry entries remain.
   • BRestore the file from quarantine because it may be a false positive.
   • CIgnore the log because the file was already deleted.
   • DReboot the system to ensure the removal is complete.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   After removing a piece of malware from a user's workstation, the admin has run a full scan and found no threats. However, the admin notices that the workstation's hosts file has been modified and contains entries redirecting known banking sites to a malicious IP. What should the admin do?

   • ADelete the hosts file entirely to remove the malicious entries.
   • BRestore the hosts file to its default state and then rescan the system.
   • CRun a memory dump analysis to check for hidden processes.
   • DLeave the hosts file as is because the malware has been removed.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company's endpoint detection and response (EDR) tool flags a benign-looking PowerShell script that is scheduled to run daily. The script downloads a file from an external URL and executes it. The script is signed by a legitimate internal developer. The EDR blocks the script, but the developer insists it is a legitimate automation task. What is the best course of action?

   • AReimage the developer's workstation because the script is likely malware
   • BAllow the script because it is signed by an internal developer
   • CDisable the scheduled task to prevent the script from running
   • DInvestigate the script's behavior and the external URL before allowing it
   Reveal Solution Discussion Select an answer first