Examkin

Question

Difficulty: EasyMalware Detection, Removal, and Prevention

A user contacts the IT helpdesk reporting that their Windows workstation is displaying suspicious pop-up messages and experiencing severe performance degradation. An IT technician inspects the device and identifies symptoms of an active malware infection. According to the standard CompTIA 7-step malware remediation process, which action should the technician perform NEXT?

  1. Isolate the workstation by disconnecting it from the local network.Answer
  2. B
    Disable System Restore in Windows settings to prevent infected restore points.
  3. C
    Update the anti-malware software definitions and perform a full system scan.
  4. D
    Re-enable System Restore and create a new system restore point.

Answer

Isolate the workstation by disconnecting it from the local network.
According to the official CompTIA 7-step malware remediation process, Step 2 requires quarantining the infected system immediately after identifying symptoms (Step 1). Disconnecting the system from the wired and wireless network isolates the threat and prevents lateral propagation.

Step-by-Step Solution

1
Identify the current step in the CompTIA 7-step malware remediation process.
The technician has already performed Step 1 (Identify and research malware symptoms).
The scenario states that malware symptoms have been confirmed on the workstation.
2
Determine the mandatory next step in the established workflow.
Step 2 is Quarantine infected systems.
Immediate containment (e.g., unplugging Ethernet or disabling Wi-Fi) stops lateral movement and unauthorized network communication before pursuing remediation.

Key Concept

CompTIA 7-Step Malware Remediation Best Practices
Rate this question

Topics

Malware Detection, Removal, and Prevention

More questions from this topic