Which of the following activities should be performed to prevent uploaded web shells from being exploited by others?

Question

Options

• ARemove the persistence mechanisms.
• BSpin down the infrastructure.
• CPreserve artifacts.
• DPerform secure data destruction.

• A
  93% (25)
• C
  4% (1)
• D
  4% (1)

Explanation

Web Shell Exploitation Prevention

Removing persistence mechanisms (Option A) is correct because web shells themselves act as persistence mechanisms - backdoors that allow attackers to maintain access to a compromised system. By identifying and removing these uploaded shells, scripts, or unauthorized files, you eliminate the foothold that could be exploited by other threat actors who discover the same vulnerability.

Why the distractors are wrong:

• Option B (Spin down infrastructure) is a drastic business-disrupting action and doesn't specifically address the web shell threat - it's more of a last resort, not a targeted prevention measure.
• Option C (Preserve artifacts) is a forensic/evidence-collection activity performed after an incident for analysis, not a preventive measure against exploitation.
• Option D (Secure data destruction) involves permanently wiping data/media, which is irrelevant to neutralizing an active web shell threat.

Memory Tip: Think of web shells as "unlocked back doors" - removing persistence mechanisms is simply locking and removing those doors before someone else walks through them. If you preserve or destroy things instead, the door is still open!

No community discussion yet for this question.