Examkin

Question

Difficulty: Very hardMalware Symptoms and Standard Removal Procedures

An IT security specialist is responding to an incident involving a Windows 11 Enterprise workstation used by a senior financial auditor. The system displays unauthorized browser redirects, altered proxy settings, and an unidentified background process named `syshost32.exe` consuming significant memory. The specialist has already completed symptom identification and fully isolated the workstation from all local and wireless networks. According to CompTIA's standard 7-step malware remediation procedure, which action should the specialist perform NEXT prior to executing remediation scans or updates?

  1. Disable System Protection (System Restore) in Windows to prevent infected state backups from persisting.Answer
  2. B
    Boot the system into Safe Mode with Networking to download the latest anti-malware engine definitions.
  3. C
    Run `sfc /scannow` from an elevated command prompt to repair corrupted system files before scanning for viruses.
  4. D
    Reconnect the host to a dedicated remediation VLAN to push automated security patches from the local WSUS server.

Answer

Disable System Protection (System Restore) in Windows to prevent infected state backups from persisting.
In the standard CompTIA 7-step malware removal model, the sequence is: 1. Identify malware symptoms, 2. Isolate infected systems, 3. Disable System Restore (in Windows), 4. Remediate infected systems, 5. Schedule scans and run updates, 6. Enable System Restore and create a restore point, 7. Educate the end user. Since symptoms have been identified and isolation is complete, the mandatory next step is to disable System Restore.

Step-by-Step Solution

1
Review the current progress within the CompTIA 7-step malware removal workflow.
Step 1 (Identify malware symptoms) and Step 2 (Isolate infected systems) have already been completed.
The technician confirmed rogue processes/redirects and disconnected all network connections.
2
Determine the mandatory next step in the procedure.
Step 3 dictates turning off System Restore (System Protection) in Windows.
Disabling System Restore purges existing restore points so malicious binaries archived in shadow copies cannot survive or be restored later.
3
Verify why alternative actions are premature or incorrect.
Updating anti-malware signatures or reconnecting to VLANs breaches isolation or prematurely skips Step 3.
Remediation (Step 4) must occur only after System Restore is disabled and isolation is strictly maintained.

Key Concept

CompTIA 7-Step Malware Removal Procedure order: Identify, Isolate, Disable System Restore, Remediate, Schedule Scans/Updates, Enable System Restore, Educate User.
Estimated Time:1m 15s
Rate this question

Topics

Malware Symptoms and Standard Removal Procedures

More questions from this topic