After a malware incident, the incident response team is writing a report. The report will be shared with management and the security team. What is the best way to structure the report?

Focus on the financial impact and omit technical details.

List all IOCs without any explanation.

Provide only the technical details for the security team.

Include an executive summary, technical findings, and recommendations.

A security team is evaluating a new anti-malware solution. The solution must detect both known and unknown malware while minimizing false positives. The team has a limited budget and cannot deploy a full sandbox for every file. Which combination of techniques is most effective?

Use only signature-based detection with frequent updates.

Use only behavioral analysis on all files.

Use signature-based detection for known malware and behavioral analysis for unknown malware.

Use static analysis on all files and sandbox only suspicious ones.

A malware analyst is analyzing a new ransomware sample. The sample is packed and uses anti-debugging techniques. The analyst needs to extract the unpacked payload and understand its behavior. Which approach is most effective?

Use static analysis to manually unpack the binary.

Submit the sample to a public malware analysis service.

Use dynamic analysis with a debugger and memory dumping to capture the unpacked payload.

Run the sample in a sandbox and rely on the report.

A large enterprise is experiencing a fast-spreading worm that encrypts files and propagates via SMB. The incident response team is under pressure to stop the spread. They have identified the worm's propagation method and the affected subnets. Which action should be taken FIRST?

Notify law enforcement and regulatory bodies.

Disconnect all affected servers from the network.

Deploy a patch for the SMB vulnerability.

Block SMB traffic between subnets at the firewall.

A company is designing a new network architecture to reduce the impact of malware. The company has a mix of legacy systems that cannot be patched and modern systems. The security team must balance security with operational requirements. Which mitigation strategy is most appropriate?

Implement strict access controls based on user roles.

Replace all legacy systems with modern ones.

Segment the network to isolate legacy systems and restrict their communication.

Deploy endpoint protection on all systems, including legacy.

CCIE Security

Domain 5Objective 2

5.2 Detect, Analyze, and Mitigate Malware Incidents CCIE-SECURITY Practice Questions (Page 9)

Part of the 5.0 Advanced Threat Protection and Content Security domain, which accounts for 20% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

8concepts

20%of the exam

Questions 41–45

41application · medium
After a malware incident, the incident response team is writing a report. The report will be shared with management and the security team. What is the best way to structure the report?
Select an answer first
42expert · hard
A security team is evaluating a new anti-malware solution. The solution must detect both known and unknown malware while minimizing false positives. The team has a limited budget and cannot deploy a full sandbox for every file. Which combination of techniques is most effective?
Select an answer first
43expert · hard
A malware analyst is analyzing a new ransomware sample. The sample is packed and uses anti-debugging techniques. The analyst needs to extract the unpacked payload and understand its behavior. Which approach is most effective?
Select an answer first
44expert · hard
A large enterprise is experiencing a fast-spreading worm that encrypts files and propagates via SMB. The incident response team is under pressure to stop the spread. They have identified the worm's propagation method and the affected subnets. Which action should be taken FIRST?
Select an answer first
45expert · hard
A company is designing a new network architecture to reduce the impact of malware. The company has a mix of legacy systems that cannot be patched and modern systems. The security team must balance security with operational requirements. Which mitigation strategy is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.