Malware Countermeasures EHE Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   A new malware variant is not detected by signature-based antivirus because its code has been modified to avoid matching known signatures. Which additional detection method is most likely to identify this variant based on its behavior?

   • AQuarantine-based detection
   • BSignature-based detection
   • CBehavioral detection
   • DFile hashing
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   What is the primary purpose of an incident response plan in the context of malware?

   • ATo provide a structured process for containing, eradicating, and recovering from malware incidents
   • BTo provide regular security awareness training to employees
   • CTo automatically patch vulnerabilities in software
   • DTo prevent all malware from entering the network
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   What is the primary function of an email security gateway?

   • ATo patch vulnerabilities in email client software
   • BTo filter email content and attachments to block malicious messages
   • CTo block unauthorized software from running on endpoints
   • DTo monitor network traffic for intrusion attempts
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A financial firm notices that malware is spreading across its internal network by exploiting a vulnerability in a legacy application. The malware communicates with external command-and-control servers. Which network-level control would most directly stop the malware's propagation and block its outbound communication?

   • AInstall a web security gateway that filters HTTPS traffic for malicious URLs.
   • BConfigure the firewall to block all inbound traffic from the internet.
   • CDeploy a NIPS with signatures for the exploit and rules to block traffic to known C2 domains.
   • DEnable stateful packet filtering on the internal router to allow only TCP traffic.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A hospital's IT department manages 500 Windows workstations used only for electronic health records (EHR) and office productivity. After a USB-borne ransomware outbreak, management wants to prevent unauthorized executables from running on these machines. The workstations have a fixed, known set of approved applications. Which control should the administrator implement to best meet the requirement?

   • AConfigure application whitelisting so only signed, approved executables can run on the workstations.
   • BDeploy a HIPS that only alerts on suspicious behavior and takes no automatic action.
   • CEnable the built-in Windows firewall and block all inbound traffic from other subnets.
   • DSet all users as standard users and remove local administrator rights.
   Reveal Solution Discussion Select an answer first