Antivirus and Antimalware

Correct Answer: Isolate affected systems and enable signature-based scanning on the antivirus software.

The best course of action for the administrator when there's an alert of a new worm outbreak would be to isolate the affected systems and enable signature-based scanning on the antivirus software. This action immediately focuses on addressing the threat by segregating the affected systems which helps to prevent further spread and by using the signature-based scanning, this increases the chances of detecting the specific worm based on its known pattern. The other answers are not the best options since waiting for a scheduled antivirus scan might result in more systems getting infected, deleting all executables on the network shares might disrupt significant normal operations and might not remove the worm, and shutting down all servers and workstations can significantly disrupt business operations and it doesn't guarantee that the worm will be removed once the systems are brought back up.

Correct Answer: Implement an email security gateway to scan incoming emails and block the ones containing malicious attachments.

The best practice to mitigate threats from malware-ridden email attachments is to implement an email security gateway. This system scans incoming emails and blocks those with potentially harmful attachments, ensuring that employees do not accidentally download malware onto their systems. The other options are less effective or practical. Banning the use of email attachments can severely limit company operations, as attachments are a standard way of sharing documents and data. Instructing employees to only open attachments from trusted sources may not be foolproof since attackers can spoof sender addresses. Lastly, while encrypting attachments can protect data in transit, it does not prevent the spread of malware through an email attachment.

Correct Answer: Disconnect the affected devices from the network

Disconnecting the affected devices is the best first step to prevent the further spread of malware within the network. Re-imaging the affected computers without isolating them first may not stop the spread. Informing the management, deploying a firewall, switching networks, and conducting training are useful steps later in the process.