Malware Countermeasures EHE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security team is choosing between an EDR solution and a traditional antivirus product. The company has a small IT staff and needs to respond to a known malware campaign that is actively targeting their industry. The EDR solution requires ongoing tuning and monitoring, while the antivirus is easier to manage. Which factor should most influence the decision?

   • AThe antivirus's compatibility with the company's existing hardware.
   • BThe EDR's ability to provide automated response actions, such as isolating infected endpoints, which is critical for a small team facing an active campaign.
   • CThe cost of the EDR solution compared to the antivirus.
   • DThe antivirus's lower management overhead, which allows the small team to focus on other tasks.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A small law firm has been hit twice in the past month by phishing emails that delivered ransomware. The firm's antivirus is signature-based and updated daily, but it missed both infections because the malware was polymorphic. The partners want a practical improvement that directly addresses the delivery method without overhauling the entire network. Which action should the IT administrator take first?

   • ARequire all employees to change their passwords every 30 days and use longer passphrases.
   • BDeploy an email security gateway that scans attachments and rewrites URLs to block known malicious links at the time of click.
   • CSwitch the antivirus product to one that uses only heuristic analysis for all file types.
   • DInstall a host-based intrusion prevention system on each workstation and configure it to block all outbound traffic.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   After a ransomware attack encrypted critical files, the company restored from backups, but the malware reappeared because the original infection vector was not addressed. Which step in the incident response process was most likely skipped?

   • ADetection — identifying that the malware was present.
   • BPreparation — developing an incident response plan.
   • CEradication — removing the malware and closing the vulnerability that allowed the initial infection.
   • DRecovery — restoring systems from backups.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company wants to block malware delivered through email attachments and malicious URLs in emails. They already have a firewall and antivirus on endpoints. Which additional control would most directly address email-borne threats?

   • AEnable the firewall's application-layer inspection for SMTP traffic.
   • BDeploy an email security gateway that scans attachments in a sandbox and rewrites URLs to check reputation at click time.
   • CInstall a host-based intrusion prevention system on all mail clients.
   • DTrain users to forward suspicious emails to the IT helpdesk.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company's development team needs to install various open-source tools and libraries on their workstations to test code. The security team wants to prevent malware from running, but the developers require the flexibility to install new software frequently. Which approach best balances security and developer productivity?

   • ADeploy a HIPS that only alerts on suspicious behavior and never blocks anything.
   • BUse application whitelisting with a policy that allows approved developer tools and requires new tools to be added through a change request process.
   • CBlock all software installations and require developers to use a separate, unmanaged machine for testing.
   • DGive developers local administrator rights and allow them to install any software without restrictions.
   Reveal Solution Discussion Select an answer first