Examkin

Question

Difficulty: HardMalware Detection, Removal, and Prevention

An IT auditor flags unauthorized background network traffic originating from a finance manager's Windows 11 workstation. A technician inspects the system, confirms an active spyware infection, and immediately disconnects the ethernet cable and disables wireless adapters to isolate the device. Next, the technician disables Windows System Restore to prevent infected files from being backed up. According to the CompTIA 7-step malware remediation process, which action should the technician perform next?

  1. Update the anti-malware software definitions using clean media and perform a full scan in Safe Mode.Answer
  2. B
    Configure automated recurring scans and system updates using Task Scheduler.
  3. C
    Re-enable System Restore and manually generate a clean restore point.
  4. D
    Provide social engineering awareness training to the finance manager.

Answer

The technician should update the anti-malware software definitions using clean media and perform a full scan in Safe Mode.
Following the standard CompTIA 7-step malware remediation process, after identifying the malware (Step 1), quarantining the system (Step 2), and disabling System Restore (Step 3), the technician must proceed to Step 4: Remediate the infected systems. Because the device is isolated from the network, anti-malware signatures should be updated from clean media, followed by scanning and removing the malware in Safe Mode or another isolated environment.

Step-by-Step Solution

1
Analyze current progress in the 7-step remediation workflow
The technician has completed Step 1 (Identify malware symptoms), Step 2 (Quarantine the infected system), and Step 3 (Disable System Restore).
Determining completed steps enables identifying the mandatory next stage in the process.
2
Determine the sequential step required next
Step 4 of the CompTIA 7-step process is 'Remediate the infected systems'.
Remediation requires updating anti-malware software signatures (via clean removable media since network connectivity is isolated) and scanning/removing the malware using safe environments like Safe Mode.
3
Match the required action to the correct choice
Updating anti-malware definitions from clean media and scanning in Safe Mode aligns precisely with Step 4.
All other choices correspond to later stages (Step 5: Schedule scans, Step 6: Re-enable System Restore, Step 7: Educate end user).

Key Concept

CompTIA 7-Step Malware Remediation Process Sequence
Rate this question

Topics

Malware Detection, Removal, and Prevention

More questions from this topic