Examkin

Question

Difficulty: Very hardMalware Detection, Removal, and Prevention

A corporate workstation on a secure network segment has triggered automated endpoint alerts for an active file-encrypting ransomware outbreak. Place the following remediation tasks in the correct sequence according to the official CompTIA 7-step malware removal procedure.

  1. 1Disconnect the infected workstation's Ethernet cable and disable its Wi-Fi adapter to prevent lateral movement across the network.
  2. 2Turn off Windows System Protection and delete existing shadow copies to prevent infected restore points from reinfecting the host.
  3. 3Boot into Safe Mode with Networking, update anti-malware definitions, and execute a full system scan to purge malicious payload files.
  4. 4Configure automatic daily background scans in the anti-malware console and apply pending OS security patches.
  5. 5Re-enable Windows System Protection and generate a clean baseline restore point.
  6. 6Conduct a mandatory training session for the user on identifying social engineering and suspicious email attachments.

Answer

The correct sequence follows the CompTIA 7-step malware removal process starting from isolation: Quarantine infected system -> Disable System Restore -> Remediate infected system -> Schedule scans and run updates -> Enable System Restore and create a restore point -> Educate the end user.
The CompTIA standard 7-step malware removal process follows a strict order: 1. Identify malware symptoms, 2. Quarantine infected systems, 3. Disable System Restore, 4. Remediate infected systems, 5. Schedule scans and run updates, 6. Enable System Restore and create a restore point, 7. Educate end user. In this scenario, symptoms have been identified by the automated alert, making quarantining the host via physical/logical network disconnection the immediate mandatory step, followed consecutively by disabling restore functions, scanning/cleaning, scheduling/updating, re-enabling restore points, and finally user education.

Step-by-Step Solution

1
Isolate the endpoint from the local network environment.
Network interfaces disabled, satisfying Step 2 (Quarantine the infected system) as symptoms are already identified in the scenario.
Prevents ransomware from spreading laterally to corporate network shares and adjacent systems.
2
Disable System Restore / System Protection on the infected endpoint.
Shadow copies and System Restore points are disabled/cleared, satisfying Step 3.
Prevents malware files stored within restore points from persisting or reinfecting the system post-remediation.
3
Perform malware scan and eradication using updated security tools.
Malicious ransomware binaries and registry entries are purged, satisfying Step 4 (Remediate infected systems).
Removes active malware threats in an isolated boot environment such as Safe Mode.
4
Configure recurring scan schedules and install latest operating system patches.
Automatic scans are scheduled and OS updates applied, satisfying Step 5.
Protects against re-infection and closes vulnerabilities exploited by malware.
5
Re-enable System Protection and create a fresh system baseline snapshot.
System Restore is re-enabled and a clean restore point created, satisfying Step 6.
Establishes a known good configuration baseline for future rollback if necessary.
6
Provide security awareness guidance to the user.
User completes training, satisfying Step 7 (Educate the end user).
Mitigates human risk factors that allowed initial malware entry.

Key Concept

CompTIA 7-Step Malware Removal Process
Rate this question

Topics

Malware Detection, Removal, and Prevention

More questions from this topic