Examkin

Question

Difficulty: HardMalware Detection, Removal, and Prevention

A desktop analyst receives a ticket regarding a corporate Windows 11 computer that has been behaving erratically, showing unauthorized background processes modifying system configurations. The analyst completes the initial symptom verification and immediately disconnects all Ethernet and Wi-Fi connections to prevent lateral movement across the internal subnet. Following standard CompTIA best-practice methodology for malware remediation, which action must the analyst perform NEXT before updating anti-malware definitions and running remediation scans?

  1. Disable Windows System Restore to prevent infected files from being saved into persistent backup snapshots.Answer
  2. B
    Restart the system into Safe Mode with Networking to automatically retrieve the latest anti-malware definition files.
  3. C
    Execute `sfc /scannow` from an elevated command prompt to repair modified core operating system binaries.
  4. D
    Re-enable System Restore and manually generate a clean restore point to safeguard existing user files.

Answer

Disable Windows System Restore to prevent infected files from being saved into persistent backup snapshots.
The CompTIA 7-step malware remediation process specifies the following strict order: 1. Identify malware symptoms, 2. Isolate infected systems, 3. Disable System Restore (in Windows), 4. Remediate infected systems (update anti-malware signatures, scan and remove threats), 5. Schedule scans and run updates, 6. Enable System Restore and create a restore point, 7. Educate the user. Because the analyst has already verified symptoms and isolated the machine from the network, the mandatory next action is to disable System Restore.

Step-by-Step Solution

1
Identify current state in the 7-step malware remediation process
Symptom verification (Step 1) and system isolation (Step 2) have already been completed by disconnecting network interfaces.
Determining the current remediation phase dictates the mandatory subsequent action.
2
Identify Step 3 of CompTIA standard remediation procedures
Step 3 specifies disabling System Restore in Windows.
If System Restore remains active during malware presence, malicious code or infected executable pointers can be saved into system restore points, leading to re-infection if restored later.
3
Select the correct action matching Step 3
Disabling System Restore purges unverified restore points prior to anti-malware updates (Step 4a) and scanning (Step 4b).
This guarantees that clean system images can eventually be created post-remediation without lingering malicious restore files.

Key Concept

CompTIA 7-Step Malware Remediation Process Execution
Rate this question

Topics

Malware Detection, Removal, and Prevention

More questions from this topic