Handling and Responding to Malware Incidents ECIH Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company is recovering from a ransomware attack. The incident response team has eradicated the malware and is now restoring systems. The company has a backup strategy that includes daily backups, but the most recent backup may contain the ransomware. The team needs to restore the systems to a clean state. Which approach is MOST appropriate?

   • ARestore from the most recent backup and then apply all security patches
   • BRestore from the last known-good backup that predates the infection
   • CRestore from the most recent backup and then run antivirus
   • DRestore from the most recent backup and then manually delete the ransomware
   Reveal Solution Discussion Select an answer first
2. 12application · easy

   A company's network was infected with malware that exploited a vulnerability in a web browser plugin. The malware was delivered when users visited a compromised website. Which infection vector was used in this incident?

   • ANetwork exploit
   • BRemovable media
   • CMalicious website
   • DEmail attachment
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A user reports that their computer is sending emails to contacts without their knowledge. The emails contain a link to a malicious website. The security team finds a program that attaches itself to other executable files and spreads when those files are shared. Which type of malware is MOST likely responsible?

   • AVirus
   • BRansomware
   • CWorm
   • DTrojan
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   An organization has been hit by a worm that exploits a vulnerability in a legacy network protocol. The worm is spreading rapidly and also installs a keylogger on infected systems. The incident response team must contain the worm. Which containment strategy is MOST effective?

   • ABlock the legacy protocol at the network perimeter and segment infected systems
   • BDisconnect all systems from the network
   • CPatch the vulnerability on all systems
   • DRun a full antivirus scan on all systems
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A user reports that their workstation is running slowly and showing pop-ups. The help desk confirms the machine is beaconing to a known malicious domain. The incident handler needs to prevent lateral movement while preserving evidence for analysis. Which action should be taken FIRST?

   • ARun an antivirus scan on the workstation
   • BDisconnect the network cable from the workstation
   • CBlock the malicious domain on the firewall
   • DPower off the workstation immediately
   Reveal Solution Discussion Select an answer first