312-50V13 · Question #127
What is the BEST alternative if you discover that a rootkit has been installed on one of your computers?
The correct answer is E. Reload from known good media. If a rootkit is discovered, the most secure and reliable action is to completely wipe the infected system and reinstall the operating system from known good media.
Question
Options
- ACopy the system files from a known good system
- BPerform a trap and trace
- CDelete the files and try to determine the source
- DReload from a previous backup
- EReload from known good media
How the community answered
(18 responses)- A11% (2)
- D6% (1)
- E83% (15)
Why each option
If a rootkit is discovered, the most secure and reliable action is to completely wipe the infected system and reinstall the operating system from known good media.
Copying system files from a known good system might not overwrite all rootkit components, as they often infect boot sectors or other low-level areas, and could also introduce file versioning issues.
Performing a trap and trace is a method for identifying the origin of an attack, not for remediating an infected system.
Deleting files and trying to determine the source is insufficient; rootkits are designed to hide, so simply deleting visible files will not remove the deeper infection, and the source might not be discoverable this way.
Reloading from a previous backup carries the risk that the backup itself might be infected if the rootkit was present at the time the backup was created.
Rootkits deeply embed themselves within the operating system, often at the kernel level, making them extremely difficult to detect and remove reliably. Therefore, the safest and most effective solution is to assume the system is irrecoverably compromised, wipe all data, and reinstall the operating system and applications from trusted, known good media to ensure complete eradication.
Concept tested: Rootkit remediation and recovery
Source: https://learn.microsoft.com/en-us/security/compass/incident-response-playbook-malware#containment
Topics
Community Discussion
No community discussion yet for this question.