Free Preparation Discussions
MENU
Eccouncil 312-39 Exam - Topic 7 Question 119 Discussion
Topic #: 7
A mid-sized hospital's SOC team has recently detected multiple malware incidents that disrupted access to patient records and caused operational inefficiencies. The SOC analysts have been tasked with eradicating current infections and preventing future attacks by addressing the underlying vulnerabilities that allowed the malware to breach defenses. As a SOC analyst, you need to recommend a step that directly targets weaknesses in the hospital's network infrastructure or system configurations exploited by the malware. Which eradication step would best address these root causes?
Eradication is about removing the threat and eliminating the conditions that allowed it to persist or recur. ''Fixing devices'' best aligns with addressing root causes because it implies remediating exploited weaknesses: patching vulnerable software, correcting misconfigurations, removing persistence mechanisms, hardening endpoints/servers, and restoring secure baselines. In healthcare environments, malware frequently exploits unpatched systems, exposed services, weak segmentation, permissive scripting policies, or inadequate least privilege. Quarantining with antivirus is helpful for immediate removal but may not eliminate the exploited vulnerability or persistence path; attackers can reinfect if the underlying gap remains. Updating signatures improves detection for known malware but does not address a misconfiguration or missing patch and will not reliably stop novel variants. Blacklisting file execution can reduce risk but is typically a partial, reactive control and can be bypassed by renaming, living-off-the-land tools, or script-based payloads. From a SOC analyst perspective, the most durable eradication action is to ''fix the device'' by restoring trusted configuration and closing the exploit vector, combined with validation scans and monitoring to confirm the environment is clean and hardened.
Catarina
4 days ago