- A
Reimage all affected workstations to remove the ransomware and then review email logs for the original phishing email.
Why wrong: Reimaging cleans the systems but does not prevent future infections; reviewing email logs is secondary to implementing macro controls.
- B
Block the external IP address at the firewall to prevent further communication with the C2 server.
Why wrong: Blocking the IP is a containment step, not identification of the initial vector.
- C
Enable macro security settings in Microsoft Office to block macros from running without explicit user consent, and enforce via Group Policy.
This directly addresses the initial infection vector by preventing macros from executing.
- D
Disable PowerShell across all workstations via Group Policy to prevent script execution.
Why wrong: While PowerShell was used, the initial vector was the document macro. Disabling PowerShell would not prevent macro execution.
Quick Answer
The correct first step is to enable macro security settings in Microsoft Office and enforce them via Group Policy, because the infection began with the execution of a macro-enabled 'invoice.docm' file. Macros are a primary vector for delivering initial payloads in phishing attacks, and blocking them from running without explicit user consent directly severs the attack chain before the PowerShell script can execute. On the Certified Ethical Hacker CEH exam, this scenario tests your understanding of endpoint hardening and attack lifecycle disruption, often appearing in questions about initial access vectors where a malicious document triggers a dropper. A common trap is focusing on post-infection controls like EDR or firewalls, but the most effective step is prevention at the source. Memory tip: think "macro = malware on-ramp" — if you block the ramp, the car never enters the highway.
CEH Cryptography and Malware Analysis Practice Question
This CEH practice question tests your understanding of cryptography and malware analysis. Examine the command output carefully: the correct answer depends on what the output actually shows, not on general recall alone. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
You are a security analyst for a financial institution. The company has deployed a network of 500 Windows 10 workstations and 50 servers running Windows Server 2019. All systems are protected by a next-generation firewall and an endpoint detection and response (EDR) solution. Recently, several employees reported that their workstations are running slowly and exhibiting unusual pop-up messages demanding a ransom note in Bitcoin. The EDR alerts show that a file named 'invoice.docm' was downloaded from an email attachment and executed on multiple workstations. The EDR also indicates that the file dropped a PowerShell script that connected to an external IP address and downloaded additional payloads. After the initial infection, the EDR detected that the ransomware binary 'encryptor.exe' was executed, which began encrypting files. However, the encryption process was stopped by the EDR before all files were encrypted. The incident response team needs to determine the source of the infection and prevent future occurrences. Which of the following is the most effective first step to identify the initial infection vector?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue:
"first"Why it matters: Order matters here. You are being tested on which action comes before the others — not which action is generally useful.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Enable macro security settings in Microsoft Office to block macros from running without explicit user consent, and enforce via Group Policy.
Option C is correct because enabling macro security settings in Microsoft Office and enforcing them via Group Policy directly addresses the initial infection vector: the 'invoice.docm' file, which is a macro-enabled document. Macros are the most common mechanism for delivering initial payloads in phishing attacks, and blocking them from running without explicit consent prevents the PowerShell script from being executed, stopping the attack chain at its source.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reimage all affected workstations to remove the ransomware and then review email logs for the original phishing email.
Why it's wrong here
Reimaging cleans the systems but does not prevent future infections; reviewing email logs is secondary to implementing macro controls.
- ✗
Block the external IP address at the firewall to prevent further communication with the C2 server.
Why it's wrong here
Blocking the IP is a containment step, not identification of the initial vector.
- ✓
Enable macro security settings in Microsoft Office to block macros from running without explicit user consent, and enforce via Group Policy.
Why this is correct
This directly addresses the initial infection vector by preventing macros from executing.
Clue confirmation
The clue word "first" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
- ✗
Disable PowerShell across all workstations via Group Policy to prevent script execution.
Why it's wrong here
While PowerShell was used, the initial vector was the document macro. Disabling PowerShell would not prevent macro execution.
Common exam traps
Common exam trap: answer the scenario, not the keyword
EC-Council often tests the distinction between containment/remediation steps and forensic identification steps; the trap here is that candidates choose a reactive measure like blocking IPs or disabling PowerShell instead of identifying the root cause (the macro-enabled document) as the first step in the incident response process.
Detailed technical explanation
How to think about this question
Macro-enabled documents (.docm) rely on VBA macros that execute when the document is opened; Office applications by default prompt users to enable macros, but attackers use social engineering to trick users into clicking 'Enable Content.' Enforcing macro security via Group Policy (e.g., setting the 'Disable all macros without notification' policy) prevents execution entirely, cutting off the attack vector at the user interaction level. This aligns with the MITRE ATT&CK technique T1204.002 (User Execution: Malicious File) and is a standard hardening recommendation from Microsoft.
KKey Concepts to Remember
- Read the scenario before looking for a memorised answer.
- Find the constraint that changes the correct option.
- Eliminate answers that are true in general but not in this case.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A practitioner preparing for the CEH exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
- →
Cryptography and Malware Analysis — study guide chapter
Learn the concepts, then practise the questions
- →
Cryptography and Malware Analysis practice questions
Targeted practice on this topic area only
- →
All CEH questions
1,010 questions across all exam domains
- →
Certified Ethical Hacker CEH study guide
Full concept coverage aligned to exam objectives
- →
CEH practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related CEH practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Footprinting, Reconnaissance and Scanning practice questions
Practise CEH questions linked to Footprinting, Reconnaissance and Scanning.
Enumeration and System Hacking practice questions
Practise CEH questions linked to Enumeration and System Hacking.
Malware, Social Engineering and Network Attacks practice questions
Practise CEH questions linked to Malware, Social Engineering and Network Attacks.
Web Application and Injection Attacks practice questions
Practise CEH questions linked to Web Application and Injection Attacks.
Introduction to Ethical Hacking practice questions
Practise CEH questions linked to Introduction to Ethical Hacking.
Scanning Networks and Enumeration practice questions
Practise CEH questions linked to Scanning Networks and Enumeration.
Vulnerability Analysis and System Hacking practice questions
Practise CEH questions linked to Vulnerability Analysis and System Hacking.
Advanced Topics: Wireless, Cloud, IoT, Cryptography practice questions
Practise CEH questions linked to Advanced Topics: Wireless, Cloud, IoT, Cryptography.
Footprinting and Reconnaissance practice questions
Practise CEH questions linked to Footprinting and Reconnaissance.
Network and Web Application Attacks practice questions
Practise CEH questions linked to Network and Web Application Attacks.
Wireless, IoT and Cloud Security practice questions
Practise CEH questions linked to Wireless, IoT and Cloud Security.
Cryptography and Malware Analysis practice questions
Practise CEH questions linked to Cryptography and Malware Analysis.
Practice this exam
Start a free CEH practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this CEH question test?
Cryptography and Malware Analysis — This question tests Cryptography and Malware Analysis — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Enable macro security settings in Microsoft Office to block macros from running without explicit user consent, and enforce via Group Policy. — Option C is correct because enabling macro security settings in Microsoft Office and enforcing them via Group Policy directly addresses the initial infection vector: the 'invoice.docm' file, which is a macro-enabled document. Macros are the most common mechanism for delivering initial payloads in phishing attacks, and blocking them from running without explicit consent prevents the PowerShell script from being executed, stopping the attack chain at its source.
What should I do if I get this CEH question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "first". Order matters here. You are being tested on which action comes before the others — not which action is generally useful.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 30, 2026
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.