CEH Cryptography and Malware Analysis Practice Question
You are a security analyst at a financial institution. The SOC has detected anomalous outbound traffic from a server in the DMZ to an unknown IP address on TCP port 8443. The server runs a custom application that normally communicates with internal databases on port 1433. The server's OS is Windows Server 2019. Preliminary analysis shows that a new service named 'UpdateSvc' was installed three days ago, set to start automatically, and runs under the LocalSystem account. The service binary is located at C:\Windows\System32\svchost.exe (the legitimate one). However, the service's 'ImagePath' registry key points to 'C:\Windows\System32\svchost.exe -k UpdateSvc'. Additionally, a scheduled task named 'HealthCheck' runs every hour and executes 'powershell.exe -EncodedCommand <base64>'. The encoded command decodes to a script that downloads a payload from the same unknown IP on port 8443 and executes it in memory. The server has antivirus installed that detected nothing. As the analyst, which of the following is the BEST immediate course of action?
⚠ Common exam trap
The trap here is that candidates focus on removing the malware artifacts (service and task) rather than containing the threat first, which is a fundamental incident response principle: isolate before eradicate.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the server from the network by disconnecting the network cable and blocking the IP at the firewall, then initiate incident response procedures.
The immediate priority is to contain the threat by isolating the compromised server from the network (disconnecting the cable) and blocking the command-and-control IP at the firewall. This stops the ongoing outbound communication on TCP port 8443 and prevents further payload downloads or data exfiltration. Initiating incident response procedures ensures proper forensic collection and analysis, which is critical before any remediation steps like reimaging or deleting artifacts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reimage the server immediately to ensure the malware is completely removed.
Why it's wrong here
Reimaging a server immediately, while effective for malware removal, is a highly destructive action that obliterates crucial forensic artifacts. This includes memory dumps, registry keys, log files, and temporary files that could reveal the malware's origin, capabilities, and exfiltration targets. This premature action prevents a thorough root cause analysis and understanding the full scope of the breach, prioritizing eradication over essential containment and investigation phases.
- ✗
Uninstall the current antivirus and install a different endpoint protection solution, then perform a full scan.
Why it's wrong here
Uninstalling and reinstalling endpoint protection is a time-consuming process that leaves the compromised server vulnerable during the transition period. More critically, this action fails to immediately stop active malicious processes, such as ongoing data exfiltration or lateral movement, which could continue unimpeded while the new solution is being deployed and scanned. The primary concern in an active compromise is immediate containment, which this approach does not address effectively or promptly.
- ✗
Delete the 'UpdateSvc' service and the 'HealthCheck' scheduled task, then run a full antivirus scan.
Why it's wrong here
Directly deleting identified persistence mechanisms like services and scheduled tasks, while seemingly proactive, risks destroying valuable forensic evidence about the malware's configuration and capabilities. Furthermore, sophisticated malware often employs multiple, redundant persistence methods, meaning removing just these two might not fully eradicate the threat and could leave other backdoors active. A full antivirus scan alone might also miss advanced, fileless, or polymorphic malware, making this a potentially incomplete and evidence-destroying approach.
- ✓
Isolate the server from the network by disconnecting the network cable and blocking the IP at the firewall, then initiate incident response procedures.
Why this is correct
Isolating the compromised server is the critical first step in containing an active security incident. Disconnecting the network cable physically severs all external and internal network communication, immediately halting data exfiltration, command-and-control (C2) communications, and preventing lateral movement to other systems. Blocking the IP at the firewall provides an additional layer of network-level containment. This action preserves the system's state for forensic analysis while stopping the immediate threat, allowing for a structured incident response process to follow.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.