Examkin

Question

Difficulty: MediumMalware Detection, Removal, and Prevention

An IT technician at a smart grid distribution control center is troubleshooting a Windows 11 workstation connected to the operational network. The technician has confirmed the presence of trojan malware and has already isolated the workstation from the network. According to the CompTIA standard 7-step malware remediation process, which TWO of the following steps should the technician perform NEXT before initiating the system scan? (Select TWO.)

  1. Disable System Restore in Windows.Answer
  2. Update anti-malware software and signature definitions.Answer
  3. C
    Enable System Restore and create a fresh system restore point.
  4. D
    Conduct end-user training on recognizing social engineering tactics.

Answer

The technician should disable System Restore in Windows and update the anti-malware software and signature definitions.
Following system isolation (Step 2), the standard CompTIA process requires disabling System Restore (Step 3) to prevent saving corrupted system files, followed by updating anti-malware signatures (Step 4a) to ensure full detection capabilities during the subsequent remediation scan.

Step-by-Step Solution

1
Determine current progress in the 7-step malware remediation process
Step 1 (Identify malware symptoms) and Step 2 (Quarantine the infected system) are already complete.
The scenario specifies that malware was identified and the workstation isolated.
2
Select the immediate next procedures required before scanning
Perform Step 3 (Disable System Restore) and Step 4a (Update anti-malware software/signatures).
System Restore must be disabled so infected files are not backed up, and scanner definitions must be updated to detect the latest malware signatures.

Key Concept

CompTIA 7-Step Malware Remediation Process
Rate this question

Topics

Malware Detection, Removal, and Prevention

More questions from this topic