Malware Countermeasures EHE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the primary purpose of application whitelisting as a malware countermeasure?

   • ATo block network traffic from known malicious IP addresses
   • BTo allow only approved software to run on a system
   • CTo quarantine infected files and prevent them from spreading
   • DTo scan all files for known malware signatures
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   After a malware infection is detected, which activity is part of the 'eradication' phase of incident response?

   • AConducting a post-incident review
   • BRestoring systems from backups
   • CIsolating the infected systems from the network
   • DRemoving the malware from all affected systems
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   An organization is designing a malware defense strategy. Which activity is primarily a malware countermeasure in the 'response' category?

   • AConfiguring a firewall to block known malicious IP addresses
   • BTraining employees to recognize phishing emails
   • CInstalling antivirus software on all endpoints
   • DIsolating an infected workstation from the network
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A company has an incident response plan, but after a malware outbreak, they discovered that the plan did not include steps for preserving forensic evidence, and the IT team deleted logs during cleanup. This hindered the investigation. Which improvement to the incident response plan would most directly address this issue?

   • AIncrease the frequency of backups to ensure data can be restored quickly.
   • BAdd a forensic evidence preservation phase that includes instructions to snapshot systems and preserve logs before any cleanup or eradication activities.
   • CTrain IT staff to immediately reimage infected systems to minimize downtime.
   • DDeploy an EDR solution that automatically deletes logs after an incident.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company's security team discovers that a previously unknown trojan is executing on several engineering workstations. The antivirus product did not flag it because no signature exists. Which combination of controls would most directly prevent this specific malware from running and provide visibility into its behavior?

   • AUpdate antivirus signatures daily and enable real-time scanning on the workstations.
   • BEnable application whitelisting on the workstations and deploy an EDR agent that records process activity.
   • CImplement a host-based intrusion prevention system (HIPS) that blocks registry modifications.
   • DConfigure the firewall to block all outbound traffic from the engineering workstations.
   Reveal Solution Discussion Select an answer first