Incident Response and Recovery →hardMultiple ChoiceObjective-mapped

SSCP Incident Response and Recovery Practice Question

An incident responder is handling a malware outbreak. The malware has been identified as a fileless threat that persists via registry run keys. Which eradication step is most appropriate?

⚠ Common exam trap

Many candidates choose reimaging (Option B) as a 'safe' default, failing to recognize that fileless malware with only registry persistence can be fully remediated by removing the registry entry and rebooting, without the operational cost of reimaging.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Remove the malicious registry entries and restart the systems.

Fileless malware that persists via registry run keys can be eradicated by removing the malicious registry entries and restarting the systems. This breaks the persistence mechanism without requiring full reimaging, as the malware does not write files to disk and relies on registry-based auto-start locations (e.g., HKCU\Software\Microsoft\Windows\CurrentVersion\Run) to execute after reboot.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Disable the affected user accounts.
Why it's wrong here
Account disabling is containment, not eradication.
✗
Reimage all affected systems.
Why it's wrong here
Reimaging is effective but may be too drastic if cleaning is possible.
✓
Remove the malicious registry entries and restart the systems.
Why this is correct
Correct. Removing persistence mechanisms is key to eradication.
✗
Run an antivirus scan on the systems.
Why it's wrong here
Antivirus may not detect fileless malware.

Go deeper

SSCP Incident Response and Recovery Practice Question

Why each option matters

Option-by-option breakdown

Related to this question