Question
A small office reported a phishing attack that resulted in a malware infection. A technician is investigating the incident and has verified the following:
- All endpoints are updated and have the newest EDR signatures.
- Logs confirm that the malware was quarantined by EDR on one system.
- The potentially infected machine was reimaged.
Which of the following actions should the technician take next?
- A. Install network security tools to prevent downloading infected files from the internet.
- B. Discuss the cause of the issue and educate the end user about security hygiene. Correct
- C. Flash the firmware of the router to ensure the integrity of network traffic.
- D. Suggest alternate preventative controls that would include more advanced security software.
Explanation
The infection has been remediated, endpoints are updated and the affected machine was reimaged, so the remaining step in the CompTIA malware removal process is to educate the end user. Because the infection started with a phishing email, discussing the cause and teaching security hygiene addresses the root cause. Flashing router firmware has no link to a phishing-borne endpoint infection, and installing new network tools or suggesting more advanced software is unnecessary when the existing EDR already detected and quarantined the malware.
