A company's security team discovers that multiple workstations were infected after users inserted USB drives found in the parking lot. The malware on the drives exploited an unpatched vulnerability in the operating system's autorun feature. Which combination of countermeasures would most effectively prevent this specific infection vector in the future?

Use a host-based intrusion prevention system (HIPS) and disable the Windows Update service

Disable autorun via Group Policy and implement a patch management process

Deploy a signature-based antivirus and block all USB ports physically

Increase user awareness training and enable Windows Defender Firewall

A workstation is infected with ransomware that has encrypted local files. The incident response team has isolated the machine from the network. What should be the NEXT step in the incident response process?

Restore files from the last backup immediately

Preserve forensic evidence and identify the ransomware variant

Immediately reimage the workstation from a known-good image

Pay the ransom to recover the encrypted files

A security administrator notices that a new, previously unseen malware variant is evading the organization's antivirus. The malware changes its code slightly each time it infects a new system. Which detection mechanism would be most effective at identifying this variant without relying on a known signature?

Allowlisting all known good applications

A company's security team is designing a defense against drive-by downloads from compromised websites. They want to protect users who visit legitimate sites that have been injected with malicious scripts. Which combination of controls would be most effective?

Web filtering with reputation-based blocking and browser isolation

User training to avoid clicking on unknown links

Antivirus software with signature updates

Disabling JavaScript in all browsers

EC-CouncilCertified Security Specialist

Domain 3Objective 3

Malware Threats and Countermeasures ECSS Practice Questions (Page 3)

Part of the Ethical Hacking Fundamentals and Core Attacks domain, which makes up ~17% of our current practice bank.

46questions here

10free pages

6concepts

Questions 11–15

11foundation · easy
After a malware infection has been contained and eradicated, which incident response step involves restoring systems to normal operation and verifying that they are clean?
Select an answer first
12application · medium
A company's security team discovers that multiple workstations were infected after users inserted USB drives found in the parking lot. The malware on the drives exploited an unpatched vulnerability in the operating system's autorun feature. Which combination of countermeasures would most effectively prevent this specific infection vector in the future?
Select an answer first
13application · medium
A workstation is infected with ransomware that has encrypted local files. The incident response team has isolated the machine from the network. What should be the NEXT step in the incident response process?
Select an answer first
14application · medium
A security administrator notices that a new, previously unseen malware variant is evading the organization's antivirus. The malware changes its code slightly each time it infects a new system. Which detection mechanism would be most effective at identifying this variant without relying on a known signature?
Select an answer first
15expert · hard
A company's security team is designing a defense against drive-by downloads from compromised websites. They want to protect users who visit legitimate sites that have been injected with malicious scripts. Which combination of controls would be most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.

Malware Threats and Countermeasures ECSS Practice Questions (Page 3)

Questions 11–15

After a malware infection has been contained and eradicated, which incident response step involves restoring systems to normal operation and verifying that they are clean?

A workstation is infected with ransomware that has encrypted local files. The incident response team has isolated the machine from the network. What should be the NEXT step in the incident response process?

A company's security team is designing a defense against drive-by downloads from compromised websites. They want to protect users who visit legitimate sites that have been injected with malicious scripts. Which combination of controls would be most effective?

Keep studying — Ethical Hacking Fundamentals and Core Attacks