SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
An organization wants to reduce the risk of malware infections from removable media. Which three of the following controls should be implemented? (Choose three.)
⚠ Common exam trap
Test-takers frequently confuse data protection controls (like encryption) with execution prevention controls, or they assume that file system formatting (NTFS) provides security against malware execution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disabling AutoRun and AutoPlay features
Disabling AutoRun and AutoPlay features prevents malicious code from executing automatically when removable media is inserted, which is a common infection vector. Using group policy to block execution from removable media stops any executable files from running, even if manually launched. Scanning all removable media with antivirus software upon insertion detects and quarantines known malware before it can interact with the system.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Disabling AutoRun and AutoPlay features
Why this is correct
Disabling AutoRun and AutoPlay features prevents the automatic execution of code from removable media when it is connected. When a USB drive or optical disc is inserted, AutoRun can read the autorun.inf file and execute a referenced payload without any user interaction, which is a primary vector for malware such as Conficker and Stuxnet. Disabling these features mitigates drive-by infections and forces users to explicitly access files, reducing the likelihood of silent malware execution.
- ✗
Enforcing a policy of full disk encryption on all removable drives
Why it's wrong here
Full disk encryption (FDE) protects the confidentiality of data stored on a removable drive by encrypting the entire volume, but it does not prevent malware from being introduced to or executed from the drive. If the system has proper authentication and access to the encrypted drive, malware can still be copied onto it, or an already-infected system can write malicious files to it. FDE is a confidentiality control, not an integrity or execution control, so it offers no significant reduction in malware infection risk from removable media.
- ✓
Using group policy to block execution from removable media
Why this is correct
Using group policy to block execution from removable media implements a Software Restriction Policy or AppLocker rule that denies code execution from removable drives. This control is highly effective because it operates at the OS level, preventing any binary (EXE, DLL, or script) from launching from the USB device, even if the malware is present on the drive. By default, many malware payloads rely on user execution; blocking execution entirely neutralizes the infection vector, making it a strong preventive measure.
- ✓
Scanning all removable media with antivirus software upon insertion
Why this is correct
Scanning all removable media with antivirus software upon insertion provides an immediate, automated check for known malware signatures before the user accesses any files. This proactive measure works by triggering a real-time scan when the device is connected, identifying and quarantining malicious files based on signature databases and heuristics. While this significantly reduces the risk of known malware infections, it is not a complete defense because zero-day threats or polymorphic malware may evade detection, so it should be part of a multi-layered security strategy.
- ✗
Requiring all removable media to be formatted as NTFS
Why it's wrong here
Requiring all removable media to be formatted as NTFS is ineffective as a malware mitigation because the file system format does not inherently block execution capabilities. NTFS supports permissions and ACLs, but these are generally not applied to removable drives used across systems, and malware can run from NTFS, FAT32, or exFAT drives equally. This requirement introduces compatibility issues with non-Windows devices and does nothing to prevent the introduction or execution of malicious code.
- ✗
Installing a host-based intrusion detection system on every workstation
Why it's wrong here
Installing a host-based intrusion detection system (HIDS) on every workstation is a detective control that monitors system logs, file integrity, and network activity for signs of intrusion, but it does not prevent malware infection from occurring in the first place. By the time a HIDS alerts on suspicious behavior, the malware may have already been executed and compromised the system. Unlike preventative controls that block auto-run or actual execution, HIDS only provides visibility after the fact, making it a poor defense against the initial infection vector from removable media.
Go deeper
Related to this question
Learn chapter
Malware Types and Characteristics
Key term
Group Policy
Group Policy is a Windows-based feature that allows administrators to centrally manage and enforce settings for users and computers across an organization.
Key term
Malware
Malware is any software intentionally designed to cause damage, disrupt operations, steal data, or gain unauthorized access to computer systems.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.