CAS-003 · Question #553
A malware infection spread to numerous workstations within the marketing department. The workstations were quarantined and replaced with machines. Which of the following represents a FINAL step in…
The correct answer is C. The workstations should be reimaged. Reimaging is the final eradication step for malware-infected workstations because it restores the system to a verified clean state, eliminating all persistence mechanisms that scanning may miss.
Question
A malware infection spread to numerous workstations within the marketing department. The workstations were quarantined and replaced with machines. Which of the following represents a FINAL step in the prediction of the malware?
Options
- AThe workstations should be isolated from the network.
- BThe workstations should be donated for refuse.
- CThe workstations should be reimaged
- DThe workstations should be patched and scanned.
How the community answered
(34 responses)- A3% (1)
- B3% (1)
- C94% (32)
Why each option
Reimaging is the final eradication step for malware-infected workstations because it restores the system to a verified clean state, eliminating all persistence mechanisms that scanning may miss.
Isolating workstations from the network is a containment action taken at the beginning of incident response, not a final remediation step.
Donating workstations is a disposal action inappropriate without data sanitization and is not part of a malware remediation process.
Reimaging overwrites the entire operating system and all storage on a compromised workstation, which is the only reliable method to eliminate advanced malware, rootkits, and persistence mechanisms that can survive patching or antivirus scanning. This step returns the workstation to a known-good baseline and is performed after containment and investigation are complete. In this scenario the infected machines were already quarantined and physically replaced, so reimaging represents the final remediation step before the replacement machines are deployed.
Patching and scanning are insufficient as final steps because sophisticated malware and rootkits can evade detection and persist through these measures.
Concept tested: Malware eradication - reimaging as final remediation step
Source: https://www.cisa.gov/sites/default/files/publications/CISA_MS-ISAC_Ransomware%20Guide_S508C.pdf
Topics
Community Discussion
No community discussion yet for this question.