CompTIA Exam PT0-003 Topic 4 Question 19 Discussion

Secure Data Destruction:

Securely deleting the web shell ensures it cannot be accessed or exploited by attackers in the future.

This involves removing the malicious file and overwriting the space it occupied to prevent recovery.

Why Not Other Options?

A (Remove persistence mechanisms): While helpful in maintaining security, this doesn't address the immediate threat of the web shell.

B (Spin down infrastructure): This could disrupt operations and doesn't directly mitigate the web shell issue.

C (Preserve artifacts): While necessary for forensic analysis, it does not prevent further exploitation of the web shell.

CompTIA Pentest+ Reference:

Domain 3.0 (Attacks and Exploits)