Handling and Responding to Malware Incidents ECIH Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A security analyst detects a trojan on a critical database server that is actively communicating with an external command-and-control server. The server cannot be taken offline because it supports a 24/7 customer-facing application. The trojan has not yet spread to other systems. Which containment strategy BEST balances risk and business continuity?

   • AAllow the trojan to continue communicating while monitoring its activity.
   • BDisconnect the server from the network entirely until the trojan is removed.
   • CKill the trojan process and immediately restore the server from backup.
   • DIsolate the server at the network level by blocking all inbound and outbound traffic except to required application servers.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A malware analyst is examining a suspicious file that is packed with an unknown packer. Static analysis reveals nothing useful. The analyst decides to perform dynamic analysis in a sandbox. Which observation would MOST strongly indicate that the malware is using anti-sandbox techniques?

   • AThe malware writes a file to the temporary directory.
   • BThe malware creates a mutex to prevent multiple instances.
   • CThe malware delays its malicious activity until a user interacts with the system.
   • DThe malware connects to a legitimate website to check internet connectivity.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A malware analyst needs to preserve evidence from an infected laptop for potential legal action. The laptop is currently powered on and the malware process is running. Which step should be taken FIRST to ensure the evidence is legally sound?

   • ACopy all files from the hard drive to an external USB drive.
   • BCapture a memory dump and create a cryptographic hash of the disk image.
   • CImmediately power off the laptop to freeze the evidence.
   • DRun a full antivirus scan to identify all malware files.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   After removing malware from a server, which action is most important before returning the server to production?

   • ADelete all logs from the server
   • BChange the server's IP address
   • CNotify all users that the server is back online
   • DVerify the integrity of the system and ensure no malicious artifacts remain
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   After containing a ransomware outbreak, the incident response team has identified the initial entry point as an unpatched vulnerability in a legacy web application. The team has removed the ransomware from all affected servers. What is the NEXT step in the eradication phase?

   • AApply the security patch to the web application
   • BMonitor network traffic for indicators of compromise
   • CRestore all servers from backup
   • DConduct a lessons-learned meeting
   Reveal Solution Discussion Select an answer first