Demonstrate Familiarity with Malware Removal 100-160 Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company's endpoint protection platform (EPP) detects a fileless attack that injected code into a legitimate system process (e.g., powershell.exe). The EPP cannot quarantine the injected code because it is running in memory. The administrator needs to remediate the endpoint while minimizing downtime for the user, who has unsaved work in an open document. What is the best approach?

   • ADisable the network adapter and continue using the system
   • BKill the powershell.exe process to remove the injected code
   • CImmediately reboot the system without capturing a memory dump
   • DCapture a memory dump for analysis, then reboot the system to clear the injected code, and rescan after reboot
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which endpoint scanning method uses behavioral patterns, such as unusual file encryption or mass file deletion, to identify malware that has not been seen before?

   • ASignature-based scanning
   • BSandboxing
   • CHeuristic analysis
   • DIntegrity checking
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   An administrator needs to scan a macOS workstation for malware. The administrator wants to check for known malware signatures and also for suspicious launch agents that may persist across reboots. Which approach is most appropriate?

   • ARun a full scan with ClamAV and check the cron jobs
   • BRun Windows Defender and check the Startup folder
   • CRun a malware scanner like Malwarebytes for Mac and inspect the LaunchAgents folder
   • DRun a network scan to detect malware on the Mac
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   A security analyst needs to detect malware that hides by modifying the operating system's core functions. Which endpoint scanning technique is specifically designed to compare the current state of system files and registry keys against a known-good baseline?

   • AHeuristic analysis
   • BSignature-based scanning
   • CIntegrity checking
   • DReal-time monitoring
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   During malware remediation, what is the primary purpose of the 'containment' step?

   • ATo identify the malware's origin
   • BTo permanently delete all infected files
   • CTo prevent the malware from spreading to other systems
   • DTo restore the system from a backup
   Reveal Solution Discussion Select an answer first