Demonstrate Familiarity with Malware Removal 100-160 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   After removing a worm from a workstation, the administrator runs a full scan and it is clean. The worm was known to spread via USB drives. What additional verification step is most important?

   • AScan all USB drives that have been connected to the workstation
   • BCheck the Windows event log for USB insertion events
   • CDisable the USB ports on the workstation
   • DRun a quick scan on the workstation
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A user reports that their Windows workstation is running slowly and showing pop-up ads. The endpoint scanner detects a potentially unwanted program (PUP) in the user's AppData folder. The scanner cannot quarantine the file because it is currently running. What should the administrator do FIRST?

   • ARestore the system to a previous restore point
   • BDelete the file directly from File Explorer
   • CDisable the network adapter to prevent further spread
   • DTerminate the associated process, then quarantine the file
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A small business has one domain controller and one file server. Both are infected with ransomware that encrypted user files. The backups are stored on a NAS that is also encrypted. The administrator has a clean backup from two weeks ago on an external drive. The business cannot afford significant downtime. What is the best recovery approach?

   • ARestore the file server from the external backup, then update the antivirus and rescan both servers
   • BReimage both servers and restore user files from the encrypted NAS
   • CPay the ransom to get the decryption key
   • DRun a full antivirus scan on both servers and then restore from the encrypted NAS
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A scan log shows the following entry: 'Threat: Backdoor.Win32.Agent, Severity: High, File: C:\Windows\System32\drivers\etc\hosts, Action: Quarantined, Status: Active'. The analyst notices that the file is the hosts file, which is a legitimate system file. What is the best interpretation of this log?

   • AThe quarantine is incomplete and the analyst should run a full scan immediately.
   • BThe malware is still active and the analyst should delete the hosts file permanently.
   • CThe hosts file was modified by malware and quarantined; the analyst should restore the original hosts file from a backup or recreate it.
   • DThe hosts file is a false positive and should be restored from quarantine immediately.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   After removing malware from an endpoint, which step is essential to verify that the malware has been completely eliminated?

   • ADisabling the antivirus software
   • BDeleting the quarantine folder
   • CRunning a full system scan with updated definitions
   • DReinstalling the operating system
   Reveal Solution Discussion Select an answer first