IPA IP 2022 Question 100

Topic: Security

A question IPA Japan published in 令和4年度 ITパスポート試験 公開問題 問100, translated into English. ITPEC is based on the same exams.

Immediately after a certain website on the Internet was viewed on a business PC connected to the wireless LAN network installed in the company, events occurred that suggest the possibility of infection with malware, such as the web browser suddenly terminating and unknown files being created. Which of the following is the appropriate action that the user of this PC should take first?

Explanation

Disconnect from the wireless LAN and isolate the PC — when malware infection is suspected, the first step is to contain it.

While the PC stays connected, malware may spread to other PCs and servers on the internal network, send data out to the attacker or receive further commands. Cutting the wireless LAN connection stops all of this at once. After isolating the PC, the user reports to the administrator or the security team, and only then is the PC investigated, cleaned and restored. Keeping the PC powered on rather than shutting it down also preserves evidence for the investigation.

Answer (c)

Why not others:

  • •(a) — reinstalling the browser does not remove malware that has already run elsewhere on the PC, and it destroys evidence while the PC stays on the network
  • •(b) — updating the definition file needs the network, so the PC stays connected while it may be infected; scanning with fresh definitions comes after isolation
  • •(d) — the encryption of the wireless link protects data in transit from eavesdroppers; it does nothing about malware already running on an authorized PC

Key rule: When malware is suspected, contain first: disconnect the device from the network and report, then investigate, remove the malware and recover.

Security · AI-written, may contain errors

Practice this exam

This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.