A server dedicated to the storage and processing of sensitive information was compromised with a rootkit and sensitive data was exfiltrated. Which of the following incident response procedures is…

Question

Options

• AWipe the storage, reinstall the OS from original media and restore the data from the last known
• BKeep the data partition, restore the OS from the most current backup and run a full system antivirus scan.
• CFormat the storage and reinstall both the OS and the data from the most current backup.
• DErase the storage, reinstall the OS from most current backup and only restore the data that was

• A
  77% (40)
• B
  13% (7)
• C
  4% (2)
• D
  6% (3)

Explanation

Rootkits are among the most persistent and stealthy forms of malware, capable of surviving reboots and hiding themselves within the OS kernel. The only trustworthy remediation is to completely wipe the storage and reinstall the OS from original, known-clean media - not from a backup, which may itself be infected. Data is then restored from the last known good (pre-infection) backup. Options B and D suggest keeping portions of the potentially compromised system or reinstalling from a backup (which may contain the rootkit). Option C reinstalls from a current backup, which risks reintroducing the rootkit. Original media ensures a clean, uninfected OS baseline.

No community discussion yet for this question.