Malware, Persistence, and Recovery
- Explain malware behavior and evidence-based recovery
- Apply the idea to evidence from a realistic technology scenario
- Justify a decision using security, reliability, cost, and user impact
Malware, Persistence, and Recovery
Malware may deliver a payload, establish persistence, communicate with an operator, steal data, or disrupt systems. Recovery requires more than deleting one file: determine scope, remove persistence, close the original weakness, reset exposed credentials, and validate clean operation.
Decision lens
Strong technical decisions connect evidence → mechanism → impact → response. Identify what the evidence shows, explain the system behavior that produced it, state the likely effect on people or data, and choose a response that addresses the cause without creating unnecessary disruption.
After a user opens an invoice attachment, files become unreadable and a note demands payment.
- 1.The symptoms are consistent with ransomware.
- 2.Disconnect affected systems to slow propagation.
- 3.Preserve evidence and activate the incident plan.
- 4.Restore from verified offline backups only after removing persistence and fixing the entry path.
Why must recovery address the initial access path?
Which response best demonstrates complete reasoning about malware behavior and evidence-based recovery?
For a scenario about malware behavior and evidence-based recovery, identify the decisive evidence before naming a response. A defensible conclusion here is: Contain first, investigate scope, eradicate the cause, then recover from trusted backups and monitor for recurrence.
Answer the 2 checkpoints as you read.
Sign in to save your progress