Examkin

Question

Difficulty: Very hardMalware Detection, Removal, and Prevention

A cybersecurity support technician is dispatched to remediate a corporate desktop that is actively displaying unauthorized ransomware warnings and generating rogue outbound connections. In what sequence should the technician perform the following incident response steps to ensure complete malware eradication according to standard CompTIA guidelines?

  1. 1Disconnect the computer from both Ethernet and Wi-Fi networks.
  2. 2Disable Windows System Restore on the infected machine.
  3. 3Update anti-malware signature files and perform a complete malware scan in Safe Mode.
  4. 4Configure automated, recurring daily anti-malware scans and automated OS patch management.
  5. 5Re-enable System Restore and manually generate a clean restore point.
  6. 6Conduct a one-on-one security awareness training session with the primary computer user.

Answer

The correct order follows the CompTIA 7-step malware removal process: (1) Quarantine the system by disconnecting network cables/Wi-Fi, (2) Disable System Restore, (3) Remediate the system by updating signatures and scanning in Safe Mode, (4) Schedule updates and recurring scans, (5) Re-enable System Restore and create a restore point, and (6) Educate the end user.
The CompTIA 7-step malware remediation process specifies an exact operational sequence: 1. Identify symptoms, 2. Quarantine infected system, 3. Disable System Restore, 4. Remediate infected systems (update anti-malware and scan/remove), 5. Schedule updates and recurring scans, 6. Enable System Restore and create restore point, and 7. Educate end user.

Step-by-Step Solution

1
Isolate the workstation (Quarantine)
Network communication is terminated, stopping malware propagation and command-and-control communication.
Step 2 of the CompTIA process dictates quarantining the system immediately after symptom identification.
2
Disable System Restore
System Restore points are cleared, eliminating stored copies of the malware.
Step 3 prevents infected files from being cached or restored later.
3
Remediate the system
Anti-malware definitions are updated and malicious files/registry keys are detected and removed.
Step 4 involves updating security tools and running deep scans to clean the operating system.
4
Schedule updates and scans
Automated security maintenance tasks are established.
Step 5 ensures ongoing preventative maintenance.
5
Enable System Restore and create a clean restore point
System recovery capabilities are restored using a known-clean baseline state.
Step 6 re-establishes OS backup functionality only after confirming system health.
6
Educate the user
The end user learns risk mitigation techniques to avoid future infections.
Step 7 finishes the remediation lifecycle by addressing human vulnerabilities.

Key Concept

CompTIA 7-Step Best-Practice Malware Removal Process
Rate this question

Topics

Malware Detection, Removal, and Prevention

More questions from this topic