Demonstrate Familiarity with Malware Removal 100-160 Practice Questions (Page 9)

Questions 41–44

1. 41application · medium

   A scan log from an endpoint shows the following: 'Threat: Adware.Win32.MultiPlug, Severity: Low, File: C:\Users\Public\Desktop\free_games.exe, Action: Detected'. The file is not quarantined or deleted. What should the analyst do based on this log?

   • AIgnore the detection because the severity is low.
   • BManually quarantine or delete the detected file and then rescan.
   • CRun a quick scan to see if the file is still present.
   • DRestore the file from quarantine to its original location.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A scan log shows a detection of 'Trojan:Win32/Emotet' with 'Action: Clean failed' and 'Error: Access denied'. The file is in C:\Windows\System32\drivers\etc\hosts. The administrator suspects the file is locked by the OS or a security product. What is the best next step?

   • AManually delete the file from Windows Explorer
   • BBoot into Safe Mode and run the scan again
   • CRestore the file from a backup
   • DDisable the security product and retry the scan
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   An analyst reviews an endpoint scan log that shows the following entry: 'Threat: Trojan.Win32.Emotet, Severity: High, File: C:\Users\Public\temp\update.exe, Action: Quarantined, Process: svchost.exe (PID 1234)'. The analyst notices the file was quarantined but the process is still listed as active. What should the analyst do first?

   • ADelete the quarantined file and then reboot the system.
   • BTerminate the associated process and then run a targeted scan of the system.
   • CRestore the quarantined file to its original location for further analysis.
   • DIgnore the process because the file is already quarantined.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A scan log shows the following entry: 'Threat: Ransom.Win32.Stop, Severity: Critical, File: C:\Users\Public\Documents\report.pdf, Action: Quarantine successful.' The file is a user document that was encrypted by the ransomware. What should the administrator do?

   • ADelete the quarantined file permanently
   • BAttempt to restore the file from a backup or shadow copy
   • CRestore the file from quarantine because it is a user document
   • DRun a quick scan to verify the system is clean
   Reveal Solution Discussion Select an answer first