Cert Master

KT-EPS Malware

EDR quarantines a signed driver loading from a temp folder. Next BEST step?

Multiple choice — select one answer

Answer choices

  1. a. Isolate host, collect timeline, and check for lateral movement indicators
  2. b. Restore driver because it is signed, without security or identity team coordination per policy.
  3. c. Disable EDR to stop alerts, without security or identity team coordination per policy.
  4. d. Reimage without any logging, without security or identity team coordination per policy.

Architectural breakdown & explanation

Signed but anomalous drivers can be malicious; investigate before release.

Correct answer(s): a. Isolate host, collect timeline, and check for lateral movement indicators

Exam domain: Malware (20% weight on the official guide).

Official documentation & study links

Practice this certification

This page is one question from the KeyTrain's Key Training — Endpoint Security bank. Run a full timed practice exam with domain-weighted random questions in your browser.

Start practice exam View exam overview All certifications