Examkin

Question

Difficulty: MediumMalware Detection, Removal, and Prevention

A desktop support technician at a municipal transit authority is responding to a Windows workstation infected with rogue adware and spyware. The technician has confirmed the malware symptoms, isolated the system from the local network, and disabled System Restore. Which of the following actions should the technician perform NEXT to adhere to the CompTIA standard malware remediation process?

  1. Update the anti-malware software signature files using a clean flash drive.Answer
  2. B
    Re-enable System Restore and create a new system restore point.
  3. C
    Schedule recurring automatic anti-malware scans and OS updates.
  4. D
    Run the System Configuration utility to disable startup services.

Answer

The technician should update the anti-malware software definitions using an offline source, such as a clean flash drive.
The CompTIA 7-step malware remediation workflow proceeds as follows: 1. Identify symptoms, 2. Quarantine system, 3. Disable System Restore, 4. Remediate infected systems (a. Update anti-malware software, b. Scan and remove), 5. Schedule scans and updates, 6. Enable System Restore and create restore point, 7. Educate end user. Since steps 1 through 3 are already completed, the next logical action is Step 4a: updating the anti-malware signature definitions.

Step-by-Step Solution

1
Identify current progress in the 7-step remediation process
Steps 1 (Identify), 2 (Quarantine/Isolate), and 3 (Disable System Restore) are complete.
Determines which step comes next in the established sequence.
2
Determine the next required step in sequence
Step 4 is Remediate infected systems, starting with updating anti-malware software/signatures (Step 4a).
Anti-malware software must have the latest signatures to effectively detect and remove modern threats.
3
Select the correct action matching Step 4a
Because network connectivity is disabled for quarantine, signatures must be updated via removable media.
Ensures the anti-malware database is current without rejoining the network prematurely.

Key Concept

CompTIA 7-Step Malware Remediation Process Order
Rate this question

Topics

Malware Detection, Removal, and Prevention

More questions from this topic