nerdexam
CompTIA

CAS-003 · Question #553

A malware infection spread to numerous workstations within the marketing department. The workstations were quarantined and replaced with machines. Which of the following represents a FINAL step in…

The correct answer is C. The workstations should be reimaged. Reimaging is the final eradication step for malware-infected workstations because it restores the system to a verified clean state, eliminating all persistence mechanisms that scanning may miss.

Enterprise Security Operations

Question

A malware infection spread to numerous workstations within the marketing department. The workstations were quarantined and replaced with machines. Which of the following represents a FINAL step in the prediction of the malware?

Options

  • AThe workstations should be isolated from the network.
  • BThe workstations should be donated for refuse.
  • CThe workstations should be reimaged
  • DThe workstations should be patched and scanned.

How the community answered

(34 responses)
  • A
    3% (1)
  • B
    3% (1)
  • C
    94% (32)

Why each option

Reimaging is the final eradication step for malware-infected workstations because it restores the system to a verified clean state, eliminating all persistence mechanisms that scanning may miss.

AThe workstations should be isolated from the network.

Isolating workstations from the network is a containment action taken at the beginning of incident response, not a final remediation step.

BThe workstations should be donated for refuse.

Donating workstations is a disposal action inappropriate without data sanitization and is not part of a malware remediation process.

CThe workstations should be reimagedCorrect

Reimaging overwrites the entire operating system and all storage on a compromised workstation, which is the only reliable method to eliminate advanced malware, rootkits, and persistence mechanisms that can survive patching or antivirus scanning. This step returns the workstation to a known-good baseline and is performed after containment and investigation are complete. In this scenario the infected machines were already quarantined and physically replaced, so reimaging represents the final remediation step before the replacement machines are deployed.

DThe workstations should be patched and scanned.

Patching and scanning are insufficient as final steps because sophisticated malware and rootkits can evade detection and persist through these measures.

Concept tested: Malware eradication - reimaging as final remediation step

Source: https://www.cisa.gov/sites/default/files/publications/CISA_MS-ISAC_Ransomware%20Guide_S508C.pdf

Topics

#incident response#malware eradication#workstation remediation#quarantine

Community Discussion

No community discussion yet for this question.

Full CAS-003 Practice