Drag and Drop Question Move each worm mitigation step from the list on the left to the correct description on the right. Note: You will receive partial credit for each correct answer. Answer:

Question

Exhibit

Answer Area

Explanation

Worm Mitigation Steps - Drag & Drop Explained

The four terms represent distinct phases of a worm incident response. Here's what each means and why it belongs to its matched description.

Position 1 → Treatment

What it is: Actively removing the worm from already-infected systems and restoring them to a clean state (running antivirus, reimaging, patching exploited vulnerabilities).

Why here: Treatment is the remediation action - it addresses the damage done. It's the most direct "fix it" step, typically matched to descriptions about cleaning or removing malware.

Position 2 → Quarantine

What it is: Isolating already-infected systems - cutting them off from the network so they can't communicate and spread the worm further, but leaving them intact for analysis.

Why here: Quarantine is reactive and targeted - it deals with systems already compromised. Distinct from Containment because it operates at the individual infected host level, not the network perimeter.

Common misconception: People confuse Quarantine with Containment. Quarantine = isolate the sick patient. Containment = lock down the building.

Position 3 → Inoculation

What it is: Patching or hardening uninfected systems proactively so they cannot be exploited by the worm - essentially "vaccinating" clean hosts.

Why here: Inoculation is preventive, not reactive. It targets systems that haven't been hit yet. This is the term most people forget or conflate with Treatment.

Common misconception: Inoculation is not about cleaning infected systems - it's about protecting healthy ones from becoming infected in the first place.

Position 4 → Containment

What it is: Limiting the worm's spread at the network level - blocking ports, segmenting VLANs, applying firewall rules, or taking down network segments to prevent lateral movement.

Why here: Containment is a broad, network-wide action. It's about restricting the blast radius, not cleaning up or protecting individual machines.

Common misconception: Containment sounds like it should come first chronologically, which trips people up. On this question, the description slot (not step order) determines placement.

Key Distinction Summary

The most common exam mistake is swapping Quarantine and Containment, or Inoculation and Treatment - remember: inoculation = vaccine (prevention), treatment = medicine (cure).

No community discussion yet for this question.