100-160 Question 170
Single answerA cybersecurity technician is performing a routine vulnerability scan on a company server. The scan identifies a suspicious file that matches known malware signatures. After isolating the file, the technician reviews the scan logs and observes the file attempted to execute multiple unauthorized network connections. What should the technician do next to effectively remediate the issue?
- A
Delete the suspicious file immediately to prevent further damage.
- B
Quarantine the file and perform a full malware scan on the system.
- C
Ignore the file, as it has already been isolated during the scan.
- D
Review the scan logs further and allow the file if it is a false positive.
Show answer and explanation
Correct answer: B
Explanation
The correct approach to malware remediation involves quarantining the suspicious file to contain the threat and performing a full malware scan to ensure the system is secure. This process minimizes risks while allowing further investigation into the incident.
- A. Incorrect.
Deleting the file immediately prevents further damage, but it does not allow for adequate investigation or ensure the system is free of additional threats.
- B. Correct.
Quarantining the file and performing a full malware scan ensures the threat is contained while allowing a comprehensive check for potential additional infections or vulnerabilities.
- C. Incorrect.
Ignoring the file is inappropriate, as further action is required to confirm the system's security and prevent re-infection.
- D. Incorrect.
Allowing the file without thorough investigation risks enabling malicious activity if the file is not a false positive.