Malware Countermeasures EHE Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which scenario best illustrates the value of user awareness training in preventing malware?

   • AA patch management system automatically updates software to fix a vulnerability
   • BA firewall blocks traffic from a known malicious IP address
   • CAn antivirus program automatically quarantines a malicious file
   • DAn employee recognizes a phishing email and reports it to the security team
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A company's security team is evaluating whether to replace their traditional antivirus with an EDR solution. The team is concerned about the EDR's agent performance impact on older endpoints and the need for 24/7 monitoring. They want to maintain a baseline of protection even if the EDR agent fails. Which approach is most appropriate?

   • ARemove the antivirus and rely solely on the EDR agent for all protection.
   • BDeploy the EDR only on servers and keep antivirus on all workstations.
   • CDeploy the EDR agent alongside the existing antivirus, configure the EDR to alert on suspicious behavior, and ensure the antivirus remains active as a fallback.
   • DUse the EDR agent in passive mode and never enable its response capabilities.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A manufacturing company's network has multiple unpatched legacy Windows 7 machines that cannot be updated due to proprietary software dependencies. These machines are on a separate VLAN but still need to communicate with a file server on the main network. The company wants to reduce the risk of malware spreading from these legacy hosts to the rest of the network. Which control should be prioritized?

   • ADisable the file server's network share and require users to transfer files via USB drives.
   • BPlace a network-based intrusion prevention system (NIPS) inline between the legacy VLAN and the main network to inspect and block malicious traffic.
   • CInstall a host-based antivirus that relies only on signature updates on each legacy machine.
   • DConfigure the existing firewall to allow all traffic between the VLANs for business continuity.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A company is planning a patch management program but faces resistance because some critical applications break after updates. The security team must reduce malware risk without disrupting business operations. Which strategy best addresses this conflict?

   • AImplement a staged rollout: test patches in a representative environment, then deploy to a small pilot group before full deployment, with rollback procedures.
   • BApply patches only to non-critical systems and leave critical applications unpatched.
   • CDefer all patches for critical applications until the vendor provides a stable release.
   • DUse application whitelisting on all systems instead of patching.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A security administrator is evaluating malware protection for a fleet of laptops that are often offline and used by traveling sales staff. The administrator wants to detect malware that may have been modified to evade signature-based detection. Which approach would be most effective for these offline endpoints?

   • ARely on cloud-based antivirus scanning that requires an internet connection.
   • BUse application whitelisting to allow only approved software to run.
   • CDeploy an EDR solution that streams all process activity to a central server.
   • DEnable heuristic and behavioral detection in the antivirus product, and configure periodic local scans.
   Reveal Solution Discussion Select an answer first