Examkin

Question

Difficulty: EasyMalware Symptoms and Standard Removal Procedures

A helpdesk technician verifies that a corporate desktop is actively infected with malware that is attempting to communicate with an external command-and-control server. According to the CompTIA standard malware removal procedure, which of the following actions should the technician perform NEXT?

  1. Quarantine the infected system by disconnecting it from the network.Answer
  2. B
    Disable System Restore in Windows to clear existing restore points.
  3. C
    Run a full anti-malware scan to clean infected files.
  4. D
    Educate the end user on proper email attachment safety.

Answer

Quarantine the infected system by disconnecting it from the network.
According to the official CompTIA 7-step malware removal process, after verifying malware symptoms (Step 1), the immediate next step is to isolate/quarantine the infected system (Step 2). Disconnecting the system from the corporate network prevents the malware from propagating or communicating with malicious servers.

Step-by-Step Solution

1
Identify current status in the removal process
The technician has confirmed and verified the malware symptoms (Step 1).
The problem scenario states that malware symptoms and active communication were verified.
2
Determine the mandatory next step in the CompTIA 7-step malware removal process
Step 2 is to isolate/quarantine the infected system.
Disconnecting the workstation from Ethernet and Wi-Fi immediately prevents network propagation and data exfiltration.

Key Concept

CompTIA 7-Step Malware Removal Procedure (Step 2: Quarantine/Isolate)
Rate this question

Topics

Malware Symptoms and Standard Removal Procedures

More questions from this topic