nerdexam
EC-Council

312-50V9 · Question #575

What is the BEST alternative if you discover that a rootkit has been installed on one of your computers?

The correct answer is E. Reload from known good media. When a rootkit is discovered, reloading from known good media is the best remediation because rootkits can survive backups and deeply embed themselves into the OS, making any other cleanup method unreliable.

Malware Threats

Question

What is the BEST alternative if you discover that a rootkit has been installed on one of your computers?

Options

  • ACopy the system files from a known good system
  • BPerform a trap and trace
  • CDelete the files and try to determine the source
  • DReload from a previous backup
  • EReload from known good media

How the community answered

(29 responses)
  • B
    10% (3)
  • C
    3% (1)
  • D
    3% (1)
  • E
    83% (24)

Why each option

When a rootkit is discovered, reloading from known good media is the best remediation because rootkits can survive backups and deeply embed themselves into the OS, making any other cleanup method unreliable.

ACopy the system files from a known good system

Copying system files from another system is unreliable because the rootkit may have infected other components beyond just system files, and manual file replacement rarely achieves a fully clean state.

BPerform a trap and trace

A trap and trace is a network monitoring or legal investigation technique used to identify an attacker's source, not a method to remediate an already-installed rootkit.

CDelete the files and try to determine the source

Manually deleting rootkit files is ineffective because rootkits actively hide themselves from the file system, making it impossible to confirm all components have been removed.

DReload from a previous backup

Reloading from a previous backup is unreliable because the backup may have been created after the rootkit was installed, meaning the infection would be restored along with the system.

EReload from known good mediaCorrect

Rootkits can hook into the kernel and modify system binaries, meaning any cleanup attempt on a running or previously backed-up system may miss hidden components. Reloading from known good media (such as original installation media or a verified clean image) guarantees the OS and system files are uncompromised. This is the only method that definitively removes all rootkit artifacts rather than trying to find and delete individual components.

Concept tested: Rootkit remediation best practice - reload from clean media

Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-83r1.pdf

Topics

#rootkit remediation#incident response#system recovery#trusted media

Community Discussion

No community discussion yet for this question.

Full 312-50V9 Practice