A company has a mix of legacy systems that cannot be patched and modern systems that are regularly updated. They are concerned about malware spreading via network shares. Which countermeasure strategy balances security and operational needs?

Force all legacy systems to be patched immediately

Segment the network to isolate legacy systems and restrict share access

Disable all file sharing across the entire network

Rely on antivirus software on all systems

During an incident, an analyst needs to determine if a suspicious file is malware. The analyst has a controlled virtual machine with network simulation. Which analysis approach would provide the most complete picture of the malware's behavior?

Heuristic analysis by comparing the file's hash to online databases

Static analysis by reading the binary's strings

Signature-based scanning with multiple antivirus engines

Dynamic analysis in the controlled VM, observing file system and registry changes

An organization is experiencing a high volume of false positives from their behavioral detection system, causing alert fatigue and missed real alerts. They want to reduce false positives without significantly reducing detection of unknown malware. Which approach is most balanced?

Increase the sensitivity of the behavioral detection system

Replace behavioral detection with heuristic detection

Tune the behavioral detection rules to require multiple suspicious actions before alerting

Disable behavioral detection and rely solely on signature-based detection

A company detects ransomware on a file server. The malware is actively encrypting files. Which step should be taken FIRST in the incident response process?

Perform a post-incident analysis to determine the attack vector

Eradicate the malware by running a full antivirus scan

Contain the threat by isolating the affected server from the network

Recover the files from backups immediately

EC-CouncilCertified Security Specialist

Domain 3Objective 3

Malware Threats and Countermeasures ECSS Practice Questions (Page 7)

Part of the Ethical Hacking Fundamentals and Core Attacks domain, which makes up ~17% of our current practice bank.

46questions here

10free pages

6concepts

Questions 31–35

31foundation · easy
An employee receives an email with an attachment that, when opened, installs malware. Which infection vector is being used?
Select an answer first
32expert · hard
A company has a mix of legacy systems that cannot be patched and modern systems that are regularly updated. They are concerned about malware spreading via network shares. Which countermeasure strategy balances security and operational needs?
Select an answer first
33application · medium
During an incident, an analyst needs to determine if a suspicious file is malware. The analyst has a controlled virtual machine with network simulation. Which analysis approach would provide the most complete picture of the malware's behavior?
Select an answer first
34expert · hard
An organization is experiencing a high volume of false positives from their behavioral detection system, causing alert fatigue and missed real alerts. They want to reduce false positives without significantly reducing detection of unknown malware. Which approach is most balanced?
Select an answer first
35application · medium
A company detects ransomware on a file server. The malware is actively encrypting files. Which step should be taken FIRST in the incident response process?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.