Certified Incident Handler (CIH) Practice Ecam

What practice should an incident handler implement to prevent fileless malware incidents?

1. Enable automatic updates

2. Terminate suspicious or unknown processes

3. Allow file sharing between systems

4. Backup data to cloud storage

The correct answer is: Terminate suspicious or unknown processes

Implementing the termination of suspicious or unknown processes is a proactive measure that an incident handler can take to prevent fileless malware incidents. Fileless malware operates by exploiting legitimate system tools and processes, making it difficult to detect using traditional signature-based antivirus solutions. By monitoring running processes and terminating those that appear suspicious or unfamiliar, incident handlers can disrupt the execution of malicious activities before they can take hold and potentially damage the system. This process aids in the immediate identification and neutralization of threats, thereby reducing the risk of infection from fileless malware, which does not rely on traditional file-based delivery methods. In contrast, enabling automatic updates may enhance overall system security through the patching of known vulnerabilities, but it does not directly address the immediate threat of fileless malware executing in real-time. Allowing file sharing between systems can introduce additional vulnerabilities, as it may facilitate the spread of malicious software. Backing up data to cloud storage is a good practice for overall data management and recovery but does not inherently prevent the execution of fileless malware or mitigate its effects during an incident. Hence, terminating suspicious processes is a focused strategy that specifically targets the nature of fileless attacks.