Malware Countermeasures EHE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A manufacturing company's OT network runs a fixed set of industrial control applications. They want to prevent any unauthorized executable from running on these critical systems. Which control is most appropriate for this environment?

   • AConfigure the firewall to block all inbound and outbound traffic except to specific IP addresses.
   • BDeploy a traditional antivirus with daily signature updates.
   • CImplement application whitelisting that only allows the known, approved control applications to execute.
   • DInstall a HIPS that blocks common exploit techniques.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company's network has a mix of legacy systems that cannot be patched and modern systems that are up to date. The security team wants to prevent malware from spreading between these systems via network exploits. They also need to allow legitimate traffic to the legacy systems. Which approach best balances security and operational requirements?

   • ABlock all inbound traffic to legacy systems except for a few specific ports.
   • BSegment the network so legacy systems are isolated and only accessible through a jump host with strict access controls.
   • CInstall host-based firewalls on the legacy systems to restrict connections to known IP addresses.
   • DDeploy a NIPS inline that uses virtual patching rules to block exploit attempts targeting known vulnerabilities in the legacy systems.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A small business wants to reduce the risk of employees downloading malware from the internet. They already have a firewall that blocks inbound traffic. Which additional measure would most directly prevent users from downloading malicious files from websites?

   • AProvide users with a list of approved websites to visit.
   • BDeploy a web content filter that blocks downloads of executable files from untrusted categories and checks URLs against reputation lists.
   • CEnable the firewall's logging feature to record all outbound connections.
   • DConfigure the firewall to block all outbound traffic on port 80.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A financial services company has a mature antivirus deployment but recently suffered a data breach where malware evaded detection for 45 days. The security team wants to improve visibility into endpoint activity and enable faster response to future incidents. They are considering an EDR solution but are concerned about the operational overhead of a 24/7 security operations center (SOC). Which approach best addresses the need for continuous monitoring and automated response while managing the SOC workload?

   • ADeploy an EDR platform with automated response playbooks that can isolate endpoints and kill malicious processes without manual intervention.
   • BPurchase a network-based intrusion prevention system and place it only at the internet perimeter.
   • CHire additional SOC analysts to manually review all endpoint logs every day.
   • DIncrease the frequency of full antivirus scans to daily and rely on the existing signature updates.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which statement best describes the primary function of a network-based intrusion prevention system (NIPS)?

   • AIt scans individual files on a host for malware signatures
   • BIt filters email attachments to prevent malware delivery
   • CIt blocks unauthorized modifications to system files on a server
   • DIt monitors network traffic and blocks malicious packets in real time
   Reveal Solution Discussion Select an answer first