A user's computer is infected with ransomware that has encrypted several files. The user has Windows Defender installed but has not updated it in months. What is the first step the user should take?

Disconnect the computer from the network to prevent the ransomware from spreading.

Run Windows Defender immediately to remove the ransomware.

Pay the ransom to get the decryption key.

Restart the computer and hope the ransomware disappears.

A critical server cannot be rebooted during business hours, but a security patch requires a reboot to take effect. The patch addresses a vulnerability that is being actively exploited. What is the best course of action?

Schedule the reboot during the next maintenance window, but apply additional monitoring and temporary mitigations (e.g., firewall rules) until then.

Reboot the server immediately, even during business hours, to apply the patch.

Skip the patch and rely on the antivirus to protect the server.

Apply the patch without rebooting and hope it takes effect.

A Windows server runs a legacy application that requires an open port (e.g., 445) for file sharing. The security team wants to reduce the attack surface but cannot change the application. What is the most effective way to protect the server while maintaining functionality?

Disable the firewall entirely to ensure the application works.

Change the application to use a different port.

Restrict the firewall rule for port 445 to only the specific IP addresses that need access, and enable logging on that rule.

Allow port 445 from any IP address to avoid connectivity issues.

Why is it important to keep antivirus definitions updated?

To change the user interface of the operating system

To increase the amount of available RAM

To improve the computer's gaming performance

To recognize and protect against the latest malware threats

Which of the following is a safe computing best practice?

Disabling security software to run faster

Sharing passwords with colleagues for convenience

Using the same password for all accounts

Downloading software only from official or trusted sources

EC-CouncilCertified Secure Computer User

Domain 1Objective 2

Securing Operating Systems CSCU Practice Questions (Page 8)

Part of the Data and Operating System Security domain, which makes up ~25% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 4–7 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

12concepts

Questions 36–40

36application · medium
A user's computer is infected with ransomware that has encrypted several files. The user has Windows Defender installed but has not updated it in months. What is the first step the user should take?
Select an answer first
37expert · hard
A critical server cannot be rebooted during business hours, but a security patch requires a reboot to take effect. The patch addresses a vulnerability that is being actively exploited. What is the best course of action?
Select an answer first
38expert · hard
A Windows server runs a legacy application that requires an open port (e.g., 445) for file sharing. The security team wants to reduce the attack surface but cannot change the application. What is the most effective way to protect the server while maintaining functionality?
Select an answer first
39foundation · easy
Why is it important to keep antivirus definitions updated?
Select an answer first
40foundation · easy
Which of the following is a safe computing best practice?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSCU

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSCU” is a trademark of its owner, used for identification only.