Demonstrate Familiarity with Malware Removal 100-160 Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A scan log shows a detection of 'Adware.Win32.OpenCandy' with 'Severity: Low' and 'Action: Quarantine successful'. The file is in C:\Users\Public\Downloads\setup.exe. The administrator is unsure whether to report this as a security incident. What is the most appropriate action?

   • ARestore the file from quarantine because it is a setup file
   • BDocument the detection and verify that the quarantine was successful, but treat it as low priority
   • CEscalate the detection as a critical incident
   • DIgnore the detection because it is low severity
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A company's endpoint protection software has detected a zero-day exploit on a user's workstation. The exploit is not yet fully understood, and the vendor has not released a signature update. The workstation is critical to the user's work and cannot be taken offline for an extended period. What is the most appropriate remediation approach?

   • ARun a full antivirus scan with the current signatures and delete any detected files.
   • BIsolate the workstation from the network, preserve the evidence, and wait for a signature update before cleaning.
   • CReimage the workstation immediately to ensure the exploit is removed.
   • DDisable the network adapter and continue using the workstation for local tasks.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   After removing a Trojan from a server, the administrator wants to confirm that the system is clean and that the malware has not left behind any persistence mechanisms. Which action is most effective for this verification?

   • AReinstall the operating system to ensure no traces remain.
   • BReview startup entries, scheduled tasks, and services for suspicious items.
   • CCheck the firewall logs for outbound connections.
   • DRun a memory dump analysis to look for hidden processes.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A small business has one file server that was infected with ransomware. The ransomware encrypted several shared folders, but the IT admin was able to isolate the server from the network. The admin has a clean backup from the previous night. What is the most appropriate next step in the remediation process?

   • APay the ransom to obtain the decryption key and then restore the files.
   • BRestore the encrypted folders from the clean backup after ensuring the ransomware is removed.
   • CReconnect the server to the network and run a full antivirus scan.
   • DDelete the encrypted files and recreate them manually from memory.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   An administrator needs to scan a Windows workstation for malware that may be hiding in the Master Boot Record (MBR). The installed antivirus does not scan the MBR during a normal scan. Which scanning method should the administrator use?

   • ARun a memory scan
   • BRun a boot-time scan
   • CRun a full scan
   • DRun a quick scan
   Reveal Solution Discussion Select an answer first