100-160 Question 169
Select 3During a routine vulnerability scan, you detect unusual file activity on a critical server. The scan logs indicate the presence of an unknown executable file that matches a known malware signature. What should be your next steps to address this issue effectively?
- A
Quarantine the file immediately to prevent further execution.
- B
Delete the file without further analysis to ensure it does not spread.
- C
Review scan logs and system logs for additional indicators of compromise (IoCs).
- D
Update the server's antivirus definitions and perform a full system scan.
- E
Reboot the server to terminate any potentially malicious processes.
Show answer and explanation
Correct answers: A, C, D
Explanation
To effectively remediate a malware infection, it is critical to isolate the threat by quarantining the file, investigate logs for additional IoCs, and scan the system with updated antivirus definitions. These steps help prevent further damage, assess the scope of the attack, and ensure the system is clean. Deleting the file prematurely may destroy evidence, while rebooting can interfere with a proper investigation.
- A. Correct.
Quarantining the file is a crucial step to isolate it and prevent it from executing further while you perform additional analysis.
- B. Incorrect.
Deleting the file immediately is not recommended without analysis, as it could erase critical evidence needed for understanding the scope of the threat.
- C. Correct.
Reviewing scan logs and system logs is essential to identify other potential compromises and understand the full extent of the malware's impact.
- D. Correct.
Updating antivirus definitions ensures that the latest threat signatures are available for detection, and a full system scan can identify any additional malware.
- E. Incorrect.
Rebooting the server is not an ideal first step, as it could terminate malicious processes but may also disrupt evidence collection or allow malware to hide during startup.