Examkin

Question

Difficulty: Very hardMalware Detection, Removal, and Prevention

An enterprise desktop administrator is responding to a malware incident on a Windows 11 workstation. The host has already been physically isolated from the local network, and System Restore has been disabled to prevent malicious persistence in volume shadow copies. Upon attempting to launch the installed anti-malware software to update definition files and clean the system, the malware actively terminates the security application processes and blocks network adapter configuration changes. Which action should the administrator take next to successfully proceed with system remediation?

  1. Boot the system into Safe Mode or an isolated Pre-installation Environment (PE) to update definitions via clean removable media and execute the remediation scan.Answer
  2. B
    Re-enable System Restore immediately and select a restore point created prior to the infection outbreak to overwrite infected system files.
  3. C
    Open Task Manager and end all active background processes running under the Local System and Network Service account privileges.
  4. D
    Run the sfc /scannow command from an elevated command prompt to download replacement antivirus signature definitions from Microsoft Update.

Answer

Boot the system into Safe Mode or an isolated Pre-installation Environment (PE) to update definitions via clean removable media and execute the remediation scan.
According to the CompTIA 7-step malware remediation process, after isolating the system and disabling System Restore, the technician must remediate the machine (Step 4). When active malware prevents normal operation or updates by killing security processes, booting into Safe Mode or using a Pre-installation Environment (PE) bypasses the malware's autostart mechanisms. Signatures can then be loaded from external media and full scans executed.

Step-by-Step Solution

1
Analyze current step in the CompTIA 7-step malware remediation process
System is isolated (Step 2) and System Restore is disabled (Step 3). The current objective is Remediation (Step 4).
Remediation requires updating anti-malware definitions and running scans/removal tools.
2
Address active malware self-defense mechanisms preventing normal scanner execution
Recognize that active malware blocking security executables must be suppressed.
Malware running with administrative privileges in standard boot mode can terminate security processes and block network sockets.
3
Select the appropriate boot environment and offline update method
Booting into Safe Mode or a WinPE environment restricts background startup items, enabling offline signature application via removable media and clean scan execution.
Safe Mode loads minimal drivers, preventing the malicious software from executing its defensive process-termination scripts.

Key Concept

CompTIA 7-Step Malware Remediation Process - Step 4: Remediate Infected Systems
Estimated Time:2m 30s
Rate this question

Topics

Malware Detection, Removal, and Prevention

More questions from this topic