Malware Countermeasures EHE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   A security team needs to investigate a potential malware infection on a laptop. Which EDR capability would be most useful for this investigation?

   • ABlocking all outbound network traffic from the laptop
   • BCollecting detailed telemetry data from the endpoint
   • CApplying the latest security patches to the laptop
   • DScanning the laptop for known malware signatures
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company wants to block malware delivered via email and web browsing, but they are concerned about false positives that could block legitimate business communications. They need a solution that filters malicious content while minimizing disruption. Which approach best meets this requirement?

   • ADisable all email attachment scanning and rely on user awareness training.
   • BBlock all email attachments and web downloads that are not from a pre-approved list of senders and domains.
   • CDeploy email and web security gateways with reputation-based filtering and sandboxing, and configure them to quarantine suspicious items for review rather than block them outright.
   • DUse only signature-based filtering on the gateways to avoid false positives.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company has just experienced a ransomware attack that encrypted several file servers. The backups are stored on a separate network and appear to be intact. Management wants to restore operations as quickly as possible, but the security team is concerned that the ransomware may have exfiltrated data before encryption. Which action should the team take first?

   • APreserve forensic evidence from the affected servers and network logs before restoring from backups.
   • BRestore all servers from backups immediately to minimize downtime.
   • CPay the ransom to obtain the decryption key and then restore from backups.
   • DDisconnect the backup network and hope the ransomware did not spread there.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   An organization wants to prevent employees from downloading executable files from the internet. Which security control is best suited for this task?

   • AHost-based intrusion prevention system (HIPS)
   • BAntivirus software
   • CWeb content filtering
   • DPatch management system
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A hospital uses a legacy medical imaging system that runs on Windows 7 and cannot be patched because the vendor has not certified any updates. The system is connected to the hospital network and is critical for patient care. Which combination of countermeasures is most appropriate to reduce the risk of malware infection on this system?

   • AInstall the latest antivirus and rely on it to protect the system.
   • BUpgrade the operating system to Windows 10 without vendor approval.
   • CSegment the system onto an isolated VLAN, restrict outbound internet access, and use application whitelisting to allow only the imaging software to run.
   • DDisconnect the system from the network and require staff to manually transfer images via USB drives.
   Reveal Solution Discussion Select an answer first