220-1102 Operational Procedures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Reimage the workstation to ensure the malware is removed

  Why it's wrong here

  Reimaging wipes the entire storage volume, permanently destroying volatile data in memory, prefetch/superfetch files, and malware artifacts embedded in the filesystem that are essential for forensic investigation. It is a last-resort remediation step that should only be executed after acquiring a forensic image and documenting the chain of custody. Performing it immediately violates the principle of evidence preservation and can compromise legal proceedings, insurance claims, and the ability to identify the attack vector.

• ✓

  Perform a forensic analysis of the infected system to gather evidence

  Why this is correct

  Forensic analysis follows the order of volatility: capturing RAM first to recover encryption keys, running processes, network connections, and in-memory malware, then creating a bit-for-bit disk image using hardware write blockers to ensure the original evidence is unaltered. This collected evidence enables investigators to determine the exact malware family, entry point, and scope of compromise, which is necessary for eradication and for meeting regulatory breach-notification requirements. Without this step, critical indicators of compromise (IOCs) are lost, making it impossible to fully remediate the threat or support potential legal action.

• ✗

  Report the incident to the company's management

  Why it's wrong here

  Reporting to management is a critical communication step in incident response, but doing it as the first action squanders the opportunity to preserve volatile evidence that decays within seconds or minutes, such as running processes and memory-resident malware. Management likely expects a technical update with root cause analysis, which can only be provided after forensic examination. An initial report without evidence may lead to incorrect assumptions, delayed containment, and failure to comply with legal obligations like data-breach notification laws, so the correct sequence is to gather evidence first, then report.

• ✗

  Remove the malware using an antivirus scan

  Why it's wrong here

  Running an antivirus scan on a live infected system alters the forensic state: the AV engine may quarantine or delete malware files, modify registry keys, and overwrite filesystem timestamps, rendering the evidence inadmissible and unusable for a detailed investigation. Furthermore, many advanced malware strains employ rootkits and polymorphic code that evade signature-based detection, so a clean scan result provides false assurance of eradication. The proper approach is to perform forensic imaging before any remediation attempt, allowing analysts to neutralize the threat without sacrificing forensic integrity.

Go deeper

Related to this question