100-160 Question 162
Select 3Your organization's antivirus software has detected a malicious file on an employee's workstation. As part of the malware removal process, what steps should you take to ensure the malware is fully removed and the system is secured?
- A
Disconnect the workstation from the network to prevent further spread.
- B
Immediately delete the malicious file without further analysis.
- C
Perform a full system scan using updated antivirus software.
- D
Restore the system to a previous backup taken before the infection occurred.
- E
Reinstall the operating system without validating the backup integrity.
Show answer and explanation
Correct answers: A, C, D
Explanation
Effective malware removal involves isolating the infected system to prevent spread, thoroughly scanning for and removing all traces of malware, and restoring the system to a secure state using validated backups. Skipping critical steps or failing to analyze the infection can leave the organization vulnerable to future attacks.
- A. Correct.
Disconnecting the workstation from the network is a critical step to prevent the malware from spreading to other systems within the network.
- B. Incorrect.
Simply deleting the malicious file without further analysis is insufficient, as malware often leaves behind residual files or system changes that need to be addressed.
- C. Correct.
Performing a full system scan using updated antivirus software ensures that any undetected malicious files or changes are identified and addressed.
- D. Correct.
Restoring the system to a previous backup taken before the infection is a reliable method to ensure the system is returned to a clean state, provided the backup is known to be uninfected.
- E. Incorrect.
Reinstalling the operating system without validating backup integrity may reintroduce the malware if the backup itself is compromised.