Demonstrate Familiarity with Malware Removal 100-160 Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A scan log shows the following entry: 'Threat: Ransom.Win32.Locky, Severity: Critical, File: C:\Users\Public\Documents\invoice.docm, Action: Quarantined, Status: Pending Restart'. What does 'Pending Restart' indicate, and what should the analyst do?

   • AThe system is clean and no further action is needed.
   • BThe malware is quarantined but removal will complete after a restart; the analyst should schedule a restart and then rescan.
   • CThe malware is still active and the analyst should delete the file manually.
   • DThe quarantine is incomplete and the analyst should run a full scan immediately.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A security team suspects that a server is infected with a rootkit that hides processes and files from the operating system. The team needs to confirm the infection and identify the malicious files. Which approach is most likely to succeed?

   • ACompare the output of 'dir' and 'tasklist' with a known-good baseline
   • BRun a network packet capture to detect rootkit communication
   • CRun a rootkit scanner from within the running OS
   • DBoot the server from a trusted live CD and run a rootkit scanner and file integrity checker
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   In a scan log, which field provides the most direct information about the potential impact of a detected threat on the system?

   • ASeverity level
   • BScan timestamp
   • CFile path
   • DThreat name
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A user reports that their Windows workstation is running slowly and showing pop-up ads. The IT admin runs a full antivirus scan, which detects a potentially unwanted program (PUP) in the user's Downloads folder. The scan log shows the PUP is not currently running and no other infections are found. What should the admin do next?

   • ARestore the file to its original location and monitor the system for changes.
   • BDelete the file immediately from the Downloads folder and inform the user.
   • CDisable the antivirus and manually remove the file from the registry.
   • DQuarantine the file, then delete it from quarantine and rescan the system.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A security analyst is investigating a suspected malware infection on a Windows workstation. The workstation is currently running, and the analyst needs to gather evidence without alerting the malware. The analyst has a trusted USB drive with portable scanning tools. Which approach is most appropriate?

   • AUse the built-in Windows Defender to run a full scan.
   • BRun a portable anti-malware scanner from the USB drive while the system is running.
   • CCopy the suspicious files to the USB drive and analyze them on a separate clean system.
   • DBoot the workstation from the USB drive and run an offline scan.
   Reveal Solution Discussion Select an answer first