A cybersecurity technician at a regional credit union is responding to a Windows 11 workstation exhibiting unauthorized background outbound traffic and rogue spyware pop-ups. The technician has confirmed the presence of malware on the system. Place the standard CompTIA remediation steps in the correct chronological order to resolve the incident.
- 1Quarantine the infected workstation by disconnecting network cables and disabling wireless adapters.
- 2Disable System Restore in Windows settings to prevent malware from being saved in system snapshots.
- 3Update anti-malware signatures and perform a comprehensive system scan to clean the infection.
- 4Re-enable System Restore and generate a clean system restore point.
- 5Provide end-user security awareness training to help the employee recognize future threats.
Answer
The correct sequence of steps is: 1) Quarantine the infected workstation by disconnecting network cables and disabling wireless adapters; 2) Disable System Restore in Windows settings; 3) Update anti-malware signatures and perform a comprehensive system scan; 4) Re-enable System Restore and generate a clean system restore point; 5) Provide end-user security awareness training.
The standard CompTIA 7-step malware removal process follows a specific lifecycle: 1. Identify malware symptoms, 2. Quarantine infected systems, 3. Disable System Restore, 4. Remediate infected systems (a. Update anti-malware software, b. Scan and use removal techniques), 5. Schedule updates and run scans, 6. Enable System Restore and create a restore point, 7. Educate the user. The correct ordering strictly adheres to this workflow by isolating the endpoint first, disabling restore snapshots prior to cleaning, running updated anti-malware tools, re-enabling restore features once clean, and finishing with end-user education.
Step-by-Step Solution
Key Concept
CompTIA 7-step Malware Remediation Process