Malware Countermeasures EHE Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   How does implementing the principle of least privilege help limit the impact of a malware infection?

   • AIt prevents malware from being downloaded from the internet
   • BIt automatically patches vulnerabilities in software
   • CIt blocks all network traffic to and from the infected system
   • DIt restricts the permissions of users and processes to only what is necessary
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A non-profit organization has a limited IT budget and cannot afford advanced security tools. Employees frequently receive phishing emails that impersonate the executive director and request urgent wire transfers. The organization wants to reduce the likelihood of employees falling for these scams. Which measure is most cost-effective and directly addresses the human factor?

   • ADisable all email forwarding and external email access for employees.
   • BInstall a free antivirus product on all workstations and rely on it to block malicious links.
   • CConduct regular security awareness training that includes simulated phishing exercises and teaches employees to verify unusual requests through a second channel.
   • DPurchase an expensive next-generation firewall for the network perimeter.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A medium-sized company is recovering from a ransomware attack that encrypted shared network drives. The investigation revealed that the malware ran under the logged-in user's account, which had domain administrator privileges. The company wants to limit the blast radius of future infections while maintaining the ability for IT staff to perform administrative tasks. Which approach best balances security and operational needs?

   • AImplement least privilege by giving all users standard accounts and providing IT staff with separate, monitored administrative accounts used only when needed.
   • BDeploy a host-based intrusion prevention system that only logs alerts and does not block any actions.
   • CDisable the network shares and require users to store all files locally on their workstations.
   • DKeep domain administrator privileges for all users to avoid productivity loss from permission issues.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A company experienced a ransomware outbreak that exploited a known vulnerability in a third-party application. The vulnerability had a patch available for two months, but it was not applied. Which countermeasure would have most directly prevented this infection?

   • ATrain users to avoid clicking suspicious links in emails.
   • BIncrease the frequency of antivirus signature updates to every hour.
   • CEstablish a patch management process that tests and deploys security updates within a defined timeframe.
   • DImplement application whitelisting on all servers.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A law firm's workstations run a standard antivirus product, but the IT manager is concerned about zero-day malware that may evade signature detection. The firm wants to add a layer of protection that monitors system calls and blocks suspicious behavior on individual endpoints. Which solution should they choose?

   • AConfigure the existing antivirus to perform a full scan every hour.
   • BDeploy a host-based intrusion prevention system (HIPS) on each workstation that monitors process behavior and blocks actions that match malicious patterns.
   • CRemove local administrator rights from all users.
   • DInstall a network-based intrusion prevention system at the internet gateway only.
   Reveal Solution Discussion Select an answer first