Restoring Functionality After a Critical Server Compromise
Question
A critical server was compromised by malware, and all functionality was lost.
Backups of this server were taken; however, management believes a logic bomb may have been injected by a rootkit.
Which of the following should a security analyst perform to restore functionality quickly?
Answers
Explanations
Click on the arrows to vote for the correct answer
A. B. C. D.C.
The scenario presented in this question involves a critical server that has been compromised by malware, and there is a suspicion that a logic bomb has been injected by a rootkit. The server is no longer functional, and backups have been taken. To restore functionality quickly, a security analyst needs to perform the most appropriate action based on the situation. Let's examine the possible answers:
A. Work backward, restoring each backup until the server is clean This approach involves restoring each backup in reverse order until the server is free from malware. While this may seem like a logical approach, it is time-consuming and does not guarantee that the malware will be completely removed. In addition, if a logic bomb has been injected, it could be triggered during the restoration process, causing further damage.
B. Restore the previous backup and scan with a live boot anti-malware scanner This option involves restoring the most recent backup and scanning it with a live boot anti-malware scanner. This approach can be effective in detecting and removing malware, including logic bombs, from the server. However, it is important to note that the live boot anti-malware scanner must be up-to-date with the latest malware definitions.
C. Stand up a new server and restore critical data from backups This approach involves standing up a new server and restoring critical data from backups. This is a quick and effective way to restore functionality, but it does not address the root cause of the issue, which is the presence of malware on the original server.
D. Offload the critical data to a new server and continue operations. This option involves offloading critical data to a new server and continuing operations. While this approach may be necessary in some cases, it does not address the root cause of the issue and may result in a loss of data if the original server cannot be restored.
In conclusion, the most appropriate answer in this scenario is B. Restore the previous backup and scan with a live boot anti-malware scanner. This approach allows for the quick restoration of functionality while also addressing the root cause of the issue by removing the malware from the server.
