Host: eng-lt-44 Containment status: network quarantined Registry artifact: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Updater = C:\Users\maria\AppData\Roaming\update.exe Scheduled task: TaskName: SysMaint Action: C:\Users\maria\AppData\Roaming\update.exe /svc Trigger: every 30 minutes File hash: update.exe SHA256 matches known malware family 'QuillDoor' User impact: - Browser pop-ups observed earlier - No confirmed encryption - No evidence of additional hosts compromised
Based on the exhibit, what is the best eradication decision after containment?
A quarantined endpoint was found to have a malicious startup item and a scheduled task. The team has already isolated it from the network and preserved memory for analysis.
Answer choices
Good practice is not just finding the correct option. The wrong answers often show the exact trap the exam wants you to fall into.
Delete only the update.exe file and reconnect the host once the user confirms it is working.
Removing one file may leave persistence mechanisms in place and can reintroduce the malware quickly.
Remove persistence artifacts and rebuild the endpoint from a known-good image before returning it to service.
The host contains a malicious executable plus two persistence mechanisms, so cleanup must remove more than the payload file. Reimaging from trusted media provides the most reliable eradication path, especially when the malware family is already identified and the machine has been quarantined. This reduces the chance of hidden remnants, registry persistence, or tampered system components surviving the response effort.
Restore network connectivity now because no encryption was observed.
The absence of encryption does not mean the endpoint is clean; persistence artifacts still exist.
Change the DNS servers for the entire enterprise to block the malware domain.
DNS changes might reduce callback traffic, but they do not eradicate the infected endpoint or its persistence.
Common exam trap
NAT is not only about the public address. The inside/outside interface roles and the ACL or rule that matches traffic are just as important.
Technical deep dive
NAT questions usually test address translation, overload/PAT behaviour, static mappings and whether the right traffic is being translated. Read the interface direction and address terms carefully.
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise SY0-701 questions linked to Security+ social engineering questions.
Practise SY0-701 questions linked to Security+ cryptography.
Practise SY0-701 questions linked to Security+ IAM questions.
Practise SY0-701 questions linked to Security+ risk management questions.
Practise SY0-701 questions linked to Security+ incident response questions.
Practise SY0-701 questions linked to Security+ malware questions.
Practise SY0-701 questions linked to Security+ vulnerability management questions.
Practise SY0-701 questions linked to Security+ security operations questions.
Practise SY0-701 questions linked to Security+ zero trust questions.
Practise SY0-701 questions linked to Security+ authentication factors questions.
Keep practising from the same exam bank, or move into a focused topic page if this question exposed a weak area.
Question 1
Question 2
Question 3
Question 4
Question 5
Question 6
FAQ
Static NAT maps one inside address to one outside address.
The correct answer is: Remove persistence artifacts and rebuild the endpoint from a known-good image before returning it to service. — The best eradication approach is to rebuild the endpoint from a known-good image after removing persistence artifacts from the incident record. The exhibit shows a confirmed malicious executable, a Run key, and a scheduled task, which means simple file deletion is not sufficient. Reimaging is the most reliable way to ensure the system returns to a trusted state before recovery and user reactivation. Why others are wrong: Option A is incomplete because it ignores two persistence mechanisms that could relaunch the malware. Option C is unsafe because the host remains compromised even without observed encryption. Option D may reduce outbound communications, but it does not clean the endpoint or eliminate the malicious startup behavior.
Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.
Sign in to join the discussion.