Question

You are the security manager for a large organization. Your NIDS has reported abnormal levels of network activity and several systems have become unresponsive. While investigating the cause of these issues, you discover a root kit on your mission-critical database server. What is the best step to take to return this system to production?

a. reconstitute the system
b. run an antivirus tool
c. instal a HIDS
d. apply vendor patches

Answer 1

Answer:A. Reconstitute the system

Explanation:A Rootkit is a combination of malicious softwares which are used by Hackers to steal previledged information or data from a system. This Hackers usually make use of Keyloggers, antivirus disablers, password disablers to prevent a person or an organization to have access to its system. It has been established that after a Rootkit the only advisable action is to Reconstitute the system, reconstitution will enable you to wipe out all system information and start all over to input new details.