nerdexam
GIAC

GSLC · Question #522

Your company network has been infected with a virus. You have cleaned all PCs, workstations, and servers. However your network still keeps getting re-infected with the same virus. Which of the…

The correct answer is A. The virus is on UPS devices. D. The virus has infected your network interface cards. UPS devices and network interface cards cannot harbor a virus because neither contains a writable execution environment where viral code could persist and re-infect the network.

Security Operations & Incident Response Leadership

Question

Your company network has been infected with a virus. You have cleaned all PCs, workstations, and servers. However your network still keeps getting re-infected with the same virus. Which of the following could NOT be a cause for this? Each correct answer represents a complete solution. Choose two.

Options

  • AThe virus is on UPS devices.
  • BUsers are downloading the virus from emails.
  • CThe virus is on printers.
  • DThe virus has infected your network interface cards.
  • EUsers have the virus on portable media such as a USB drive.

How the community answered

(27 responses)
  • A
    78% (21)
  • B
    7% (2)
  • C
    11% (3)
  • E
    4% (1)

Why each option

UPS devices and network interface cards cannot harbor a virus because neither contains a writable execution environment where viral code could persist and re-infect the network.

AThe virus is on UPS devices.Correct

UPS (Uninterruptible Power Supply) devices are purely electrical hardware designed to regulate and supply backup power; they contain no writable storage medium or operating system capable of storing or executing viral code. Because a virus requires a persistent, writable environment to embed itself, a UPS device is fundamentally incapable of acting as a re-infection vector.

BUsers are downloading the virus from emails.

Downloading infected email attachments is a well-documented and common re-infection vector, meaning this CAN be a cause and is therefore not a valid answer to 'cannot be a cause'.

CThe virus is on printers.

Modern network printers contain embedded operating systems, persistent flash storage, and sometimes hard drives, all of which can store and spread malware, making them a legitimate re-infection source.

DThe virus has infected your network interface cards.Correct

Network Interface Cards operate at the physical and data-link layers using firmware stored in read-only memory that typical malware cannot modify or infect. Because NICs have no user-accessible writable storage and no execution environment for arbitrary code, a conventional virus cannot persist on or propagate from a NIC.

EUsers have the virus on portable media such as a USB drive.

Infected USB drives and other portable media are a classic and highly common re-infection pathway, reintroducing the virus to the network each time the media is connected to a cleaned machine.

Concept tested: Identifying non-viable malware re-infection vectors

Topics

#virus reinfection#persistent malware#portable media#network infection vectors

Community Discussion

No community discussion yet for this question.

Full GSLC Practice