Examkin

Question

Difficulty: HardMalware Detection, Removal, and Prevention

An IT technician in an engineering laboratory responds to a workstation flagged for suspicious file-encrypting worm activity. The technician has already quarantined the machine by disconnecting its network cable and disabling all wireless adapters. Which of the following actions should the technician perform NEXT before conducting a full system anti-malware scan? (Select TWO.)

  1. Disable System Restore on the infected workstation to prevent malicious files from being cached in restore points.Answer
  2. Download the latest anti-malware signature updates on a clean machine and transfer them to the isolated system using removable media.Answer
  3. C
    Reconnect the workstation to an isolated VLAN to download cloud-based antivirus updates directly from the software vendor.
  4. D
    Run the sfc /scannow command from an elevated command prompt to locate and purge active malware payloads.

Answer

The technician must disable System Restore on the infected system and manually update anti-malware definitions using removable media before scanning.
Following the CompTIA 7-step malware remediation process, once a system is quarantined (Step 2), the technician must disable System Restore (Step 3) to prevent clean files from being overwritten by infected restore points. The technician must then update anti-malware signature definitions (Step 4a) out-of-band using removable media to keep the system isolated before initiating full scans (Step 4b).

Step-by-Step Solution

1
Review current remediation stage within the CompTIA 7-step process
Step 1 (Identify malware symptoms) and Step 2 (Quarantine the infected system) are already complete.
Determining current progress identifies which prerequisite steps remain prior to active remediation.
2
Execute Step 3 of malware remediation (Disable System Restore)
System Restore is turned off, clearing existing restore points.
If System Restore remains enabled, Windows might back up infected system files or allow malware to restore itself after clean-up.
3
Execute Step 4a of malware remediation (Update anti-malware environment)
Anti-malware signatures are updated out-of-band via USB flash drive without reconnecting to the network.
Scanning with outdated definitions may miss new variants, while reconnecting to a network breaks quarantine.

Key Concept

CompTIA 7-Step Malware Remediation Process
Estimated Time:2m 0s
Rate this question

Topics

Malware Detection, Removal, and Prevention

More questions from this topic