200-201 Question 340
Select 4A cybersecurity analyst in your organization identifies malware spreading laterally across the network. After isolating the affected systems, what steps should the analyst prioritize next to ensure proper containment, eradication, and recovery?
- A
Disconnect all infected systems from the network to prevent further spread.
- B
Run a system-wide backup of all affected machines to preserve data in its current state.
- C
Identify and remove malicious files or processes from the infected systems based on malware signature analysis.
- D
Investigate the root cause of the infection and patch any exploited vulnerabilities.
- E
Reimage the affected systems and restore them from clean, verified backups.
Show answer and explanation
Correct answers: A, C, D, E
Explanation
Proper incident response involves containment, eradication, and recovery steps. Disconnecting infected systems stops the spread of malware, while removal of malicious files and root cause analysis ensures the malware is eradicated and vulnerabilities are addressed. Reimaging systems and restoring from clean backups completes the recovery process to return systems to a secure operational state. However, backing up infected systems is not recommended as it may unintentionally preserve the malware.
- A. Correct.
Disconnecting all infected systems is a critical containment step to stop the malware from spreading further within the network.
- B. Incorrect.
Running a system-wide backup of infected machines is not recommended as it could preserve malicious files or processes, potentially reintroducing the malware during recovery.
- C. Correct.
Removing malicious files or processes after identification is a key eradication step to ensure the malware is eliminated from the infected systems.
- D. Correct.
Investigating the root cause and patching vulnerabilities is essential to prevent reinfection and address the initial attack vector.
- E. Correct.
Reimaging the systems and restoring them from clean, verified backups ensures recovery to a secure state, free from malware.