Handling and Responding to Malware Incidents ECIH Practice Questions (Page 11)

Questions 51–55

1. 51expert · hard

   A large organization has detected a malware infection on a domain controller. The malware appears to be a credential-stealing trojan that is spreading via SMB. The incident response team must contain the threat while preserving evidence for a potential criminal investigation. The domain controller is critical for authentication. Which containment strategy BEST balances the need to stop the spread and preserve evidence?

   • AImmediately power off the domain controller to stop the spread
   • BReset all user passwords and then isolate the DC
   • CBlock SMB traffic at the firewall while keeping the DC online
   • DIsolate the domain controller from the network and take a forensic image before any further action
   Reveal Solution Discussion Select an answer first
2. 52expert · hard

   After a major malware incident, the incident response team conducts a post-incident review. The review reveals that the malware entered through a phishing email that bypassed the email filter, and that the incident response plan did not include clear roles for communication. Which improvement is MOST critical to prevent a similar incident?

   • APurchase additional antivirus licenses
   • BUpdate the incident response plan with clear communication roles
   • CIncrease the frequency of backups
   • DEnhance email filtering and implement user awareness training
   Reveal Solution Discussion Select an answer first
4. 53application · medium

   A malware analyst has a suspicious executable that is believed to be a new strain of ransomware. The analyst needs to understand the malware's behavior without risking the production network. Which approach is the MOST appropriate?

   • AExecute the malware in a controlled, isolated virtual machine
   • BDisassemble the malware using a debugger on the analyst's workstation
   • CUpload the malware to an online scanning service
   • DRun the malware on a spare production server
   Reveal Solution Discussion Select an answer first
5. 54application · medium

   During triage, a security analyst identifies a worm that propagates over SMB by exploiting a known vulnerability. The worm has infected 10 of 200 workstations in a single subnet. Which containment action should be taken FIRST to limit spread?

   • APower off all 10 infected workstations immediately.
   • BApply the vendor security patch to all 200 workstations.
   • CBlock SMB traffic (ports 445/139) between the affected subnet and the rest of the network at the firewall.
   • DDisconnect the entire subnet from the network.
   Reveal Solution Discussion Select an answer first
6. 55application · medium

   A company has experienced multiple malware infections traced to USB drives left in the parking lot. Employees plug the drives into their workstations out of curiosity. Which control would be MOST effective to prevent this infection vector?

   • ADisable USB ports on all workstations via group policy.
   • BEducate employees about the dangers of unknown USB drives.
   • CRun antivirus scans on all USB drives before use.
   • DMonitor network traffic for signs of malware.
   Reveal Solution Discussion Select an answer first