Handling and Responding to Malware Incidents ECIH Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which of the following is an example of a remediation action during the eradication phase?

   • AApplying a security patch to close the vulnerability exploited by the malware
   • BDisconnecting the infected system from the network
   • CRestoring user data from a backup
   • DCreating a disk image of the infected system
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security operations center receives an alert about a workstation that is making repeated connections to a known malicious IP address. The workstation is also running a process that is not in the company's approved software list. Which triage action should the analyst take FIRST?

   • AEscalate the alert to the incident response team.
   • BVerify the alert by checking the workstation's process list and network connections.
   • CImmediately disconnect the workstation from the network.
   • DSearch the company's threat intelligence feed for the malicious IP.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is the main purpose of a post-incident review (lessons learned) after a malware incident?

   • ATo immediately restore all systems without further analysis
   • BTo identify what went well and what can be improved in future incident responses
   • CTo delete all evidence related to the incident
   • DTo assign blame to individuals who caused the incident
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   After removing ransomware from a file server, the incident handler wants to ensure the malware does not reappear. The initial infection occurred through an unpatched vulnerability in the server's web management interface. Which action is MOST critical during the eradication phase?

   • ARestore all encrypted files from the latest backup.
   • BRun a full antivirus scan on the server.
   • CApply the vendor security patch to the web management interface.
   • DChange the administrator password for the server.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   What is the primary purpose of dynamic malware analysis?

   • ATo observe the malware's behavior in a controlled environment
   • BTo calculate the malware's hash value
   • CTo extract strings from the malware binary
   • DTo identify the malware's file type without executing it
   Reveal Solution Discussion Select an answer first