A security analyst is categorizing the countermeasures used to protect systems from malware. Which of the following correctly lists the three primary categories of malware countermeasures?

Firewalls, antivirus, and intrusion detection

Prevention, detection, and response

Encryption, hashing, and digital signatures

Technical, administrative, and physical controls

A vulnerability management program is most effective at reducing malware infections when it includes which of the following?

Blocking all inbound and outbound network traffic

Deleting all suspicious files from the system

Training users to avoid clicking on unknown links

Regular scanning and timely patching of identified vulnerabilities

A user reports that their computer is running slowly and showing pop-ups. The IT team suspects malware but the antivirus scan comes back clean. The malware appears to be a new variant that changes its code each time it runs. Which detection method is most likely to identify this malware?

Check the file's digital signature and compare it to a list of known good publishers.

Use behavioral analysis that monitors the program's actions, such as registry modifications and network connections, rather than relying on file signatures.

Run a full signature-based scan with the latest virus definitions.

Disable the antivirus and rely on the Windows built-in firewall to block the malware.

A company is implementing least privilege but faces resistance because some employees need to install software for their job functions. The security team wants to prevent malware while allowing necessary software installations. Which approach best satisfies both requirements?

Grant administrative rights to all employees who request them, but require them to complete security awareness training.

Allow employees to install software only after submitting a helpdesk ticket and receiving approval.

Use a software deployment tool that installs approved applications with administrative privileges, while users have standard accounts and application whitelisting is enforced.

Disable application whitelisting and rely on antivirus to detect malware.

A retail company's employees frequently browse the web for product research. The security team wants to block access to known malicious websites and prevent downloads of potentially unwanted programs (PUPs) without blocking legitimate business sites. Which control should they implement?

Deploy a web security gateway that filters URLs against reputation lists and blocks downloads based on file type and category.

Install a personal firewall on each workstation and disable all browser downloads.

Configure the firewall to block all outbound HTTPS traffic.

Instruct employees to only visit websites that start with 'https'.

EC-CouncilEthical Hacking Essentials

Domain 2Objective 3

Malware Countermeasures EHE Practice Questions (Page 5)

Part of the Malware and Password Attacks domain, which makes up ~14% of our current practice bank.

58questions here

12free pages

12concepts

12 Concepts in This Objective

Malware countermeasures overview
Antivirus and anti-malware software
Host-based intrusion prevention
Network-based intrusion prevention
Firewalls and malware filtering
Patch management and vulnerability mitigation
User awareness and training
Least privilege and access control
Application whitelisting
Email and web security gateways
Endpoint detection and response (EDR)
Incident response and recovery planning

Questions 21–25

21foundation · easy
A security analyst is categorizing the countermeasures used to protect systems from malware. Which of the following correctly lists the three primary categories of malware countermeasures?
Select an answer first
22foundation · easy
A vulnerability management program is most effective at reducing malware infections when it includes which of the following?
Select an answer first
23application · medium
A user reports that their computer is running slowly and showing pop-ups. The IT team suspects malware but the antivirus scan comes back clean. The malware appears to be a new variant that changes its code each time it runs. Which detection method is most likely to identify this malware?
Select an answer first
24expert · hard
A company is implementing least privilege but faces resistance because some employees need to install software for their job functions. The security team wants to prevent malware while allowing necessary software installations. Which approach best satisfies both requirements?
Select an answer first
25application · medium
A retail company's employees frequently browse the web for product research. The security team wants to block access to known malicious websites and prevent downloads of potentially unwanted programs (PUPs) without blocking legitimate business sites. Which control should they implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to EHE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “EHE” is a trademark of its owner, used for identification only.