312-50 Question 177
Single answer▪ Malware CountermeasuresA security analyst discovers that several Windows workstations are making repeated outbound HTTPS connections to a newly registered domain every few minutes. EDR telemetry shows a suspicious process launched from a user's AppData directory and creating a Run registry key for persistence. The analyst has confirmed malware infection on one host and wants to prevent lateral spread while preserving evidence for investigation. What is the MOST appropriate next step?
- A
Immediately run antivirus full scans on all workstations and reboot infected systems to remove the malware as quickly as possible
- B
Disconnect the confirmed infected host from the network, capture volatile evidence, and then begin containment and eradication procedures
- C
Delete the suspicious executable from the AppData folder and remove the Run registry key so the malware cannot restart
- D
Block all outbound HTTPS traffic at the perimeter firewall until the malicious domain can be fully investigated
Show answer and explanation
Correct answer: B
Explanation
In malware incidents, the priority is typically containment, evidence preservation, eradication, and recovery, in that order, adjusted to business risk. When a host is confirmed infected, isolating it from the network helps stop command-and-control traffic and reduces the chance of lateral spread. Before rebooting or deleting artifacts, responders should collect volatile evidence such as active network connections, process trees, memory contents, and logged-on users. This aligns with established incident handling guidance such as NIST SP 800-61 Computer Security Incident Handling Guide, which emphasizes containment strategies and preserving evidence for analysis. In practical CEH-style scenarios, the best answer is the one that both limits the attacker's ability to continue operations and supports proper forensic investigation.
- A. Incorrect.
This is not the best first step. Running AV scans broadly may be part of eradication, but immediately rebooting infected systems can destroy volatile evidence such as running processes, network connections, loaded modules, and decrypted malware artifacts in memory. It also does not prioritize containment of the confirmed host before spread occurs.
- B. Correct.
This is the best answer. Standard incident response and malware countermeasure practice is to contain the infected system first to reduce further communication and lateral movement, while preserving forensic value. Capturing volatile data before remediation helps investigators identify malware behavior, command-and-control indicators, and persistence mechanisms. After evidence is preserved, containment and eradication can proceed in a controlled manner.
- C. Incorrect.
This is a common but flawed response. Manually deleting the file and registry key may remove one visible persistence mechanism, but it risks tipping off the attacker, missing additional malware components, and destroying evidence needed for root-cause analysis. Malware often uses multiple persistence methods or secondary payloads, so ad hoc deletion is not a reliable first response.
- D. Incorrect.
This is overly disruptive and not appropriately scoped as the first action. Blocking all outbound HTTPS would severely impact business operations and still would not isolate the infected endpoint or preserve evidence. A more targeted control such as isolating the host and blocking the known malicious domain or indicators is more appropriate after initial containment.