Examkin

Question

Difficulty: HardMalware Symptoms and Standard Removal Procedures

A desktop technician is performing malware remediation on a compromised Windows 10 workstation controlling automated machinery on a manufacturing floor. The technician has already confirmed malware infection symptoms and physically disconnected the ethernet cable to isolate the system. In what exact order should the technician perform the remaining steps to complete the standard CompTIA malware removal process?

  1. 1Disable System Restore (System Protection) in Windows.
  2. 2Update anti-malware signatures offline and execute a full scan in Safe Mode.
  3. 3Configure recurring automated scans and schedule OS security updates.
  4. 4Enable System Restore and generate a clean system restore point.
  5. 5Conduct end-user security training with the manufacturing floor operators.

Answer

The correct sequence for the remaining remediation steps is: Disable System Restore, Update anti-malware signatures offline and execute a full scan, Configure recurring automated scans and schedule OS security updates, Enable System Restore and generate a clean system restore point, and Conduct end-user security training.
According to CompTIA's official 7-step malware removal process, after identifying the symptoms (Step 1) and isolating the system (Step 2), the technician must proceed through the remaining steps in strict sequence: Step 3 is Disabling System Restore, Step 4 is Remediating infected systems (updating anti-malware signatures and scanning), Step 5 is Scheduling scans and running updates, Step 6 is Enabling System Restore and creating a new restore point, and Step 7 is Educating the end user.

Step-by-Step Solution

1
Identify malware symptoms
Malware presence confirmed (already completed in scenario).
Establishes the problem state before taking remediation steps.
2
Isolate infected systems
Ethernet cable disconnected (already completed in scenario).
Prevents lateral movement across the manufacturing network.
3
Disable System Restore
System Protection disabled; corrupted restore points purged.
Prevents the infected system from keeping backup copies of infected binaries during cleaning.
4
Remediate infected systems
Anti-malware definitions updated via external media and full system scan completed.
Ensures active malicious processes and files are completely quarantined and erased.
5
Schedule scans and run updates
Scheduled tasks created for periodic scanning and Windows Update checks.
Ensures long-term protection against re-infection.
6
Enable System Restore and create restore point
System Protection enabled; baseline restore point created.
Provides a healthy recovery baseline now that the OS is known clean.
7
Educate end user
Operators trained on security awareness and threat prevention.
Reduces human-factor vulnerability to future attacks.

Key Concept

CompTIA 7-Step Best Practice Methodology for Malware Removal
Rate this question

Topics

Malware Symptoms and Standard Removal Procedures

More questions from this topic