100-160 Question 167
Select 3A cybersecurity technician is conducting a routine scan of the organization's systems using a vulnerability scanning tool. The scan detects multiple vulnerabilities, including one categorized as 'Critical'. Upon reviewing the scan logs, the technician notices that this vulnerability is related to a known malware that exploits an unpatched software version. What should the technician do next?
- A
Isolate the affected system from the network to prevent further exploitation
- B
Immediately patch the software without further investigation
- C
Review the impacted system for signs of malware activity
- D
Update the organization's antivirus/antimalware definitions and perform a full scan
- E
Ignore the vulnerability if the system is not actively showing signs of compromise
Show answer and explanation
Correct answers: A, C, D
Explanation
When a critical vulnerability is detected, the technician must take immediate and appropriate actions to mitigate the risk. Isolating the affected system prevents the spread of malware, reviewing for signs of compromise verifies the extent of the issue, and updating antivirus definitions ensures the organization is prepared to detect and remove any malware. Patching should occur only after ensuring the system is stable and free from compromise. Ignoring the issue is never an acceptable option.
- A. Correct.
Isolating the affected system is a critical first step to prevent the potential spread of malware while the issue is being addressed.
- B. Incorrect.
Patching the software immediately without further investigation could lead to unintended consequences if the system is already compromised. Proper analysis is needed first.
- C. Correct.
Reviewing the system for signs of malware activity is necessary to confirm whether the vulnerability has been exploited or is just a potential risk.
- D. Correct.
Updating antivirus/antimalware definitions and performing a full scan helps detect and remove any existing malware that may have exploited the vulnerability.
- E. Incorrect.
Ignoring the vulnerability is a poor practice, as vulnerabilities classified as 'Critical' need to be addressed promptly, regardless of immediate signs of compromise.