Examkin

Question

Difficulty: MediumMalware Symptoms and Standard Removal Procedures

A desktop support technician at a maritime shipping terminal is responding to a Windows workstation exhibiting active ransomware symptoms. Place the following CompTIA standard malware remediation actions in the correct order from first to last.

  1. 1Disconnect the workstation's network cable and disable wireless interfaces.
  2. 2Turn off Windows System Restore.
  3. 3Update anti-malware definitions and execute a complete remediation scan.
  4. 4Re-enable Windows System Restore and create a clean restore point.
  5. 5Provide security awareness guidance to the terminal operator on phishing prevention.

Answer

The correct order of steps is: 1. Disconnect the workstation's network cable and disable wireless interfaces. 2. Turn off Windows System Restore. 3. Update anti-malware definitions and execute a complete remediation scan. 4. Re-enable Windows System Restore and create a clean restore point. 5. Provide security awareness guidance to the terminal operator on phishing prevention.
According to CompTIA's 7-step malware removal procedure, the technician must first isolate the system from the network to stop lateral spread. Next, System Restore must be disabled so that infected files are not retained in system restore points. Once disabled, the technician updates anti-malware signatures and remediates the computer. After confirming remediation, System Restore is re-enabled and a new restore point is generated. Finally, educating the end user prevents recurrence.

Step-by-Step Solution

1
Isolate the infected device.
Prevents ransomware from scanning network shares or propagating across the port terminal network.
CompTIA Step 2 requires network isolation before performing any changes or scans on the host.
2
Disable System Restore.
Prevents Windows from saving infected binaries or encrypted state into system restore points.
CompTIA Step 3 requires turning off System Restore prior to cleaning the system.
3
Remediate the infected system.
Cleans the malware files from the hard drive and memory.
CompTIA Step 4 involves updating anti-malware software and scanning/removing malicious content.
4
Enable System Restore and generate a clean restore point.
Creates a valid, uninfected system snapshot for future rollback capabilities.
CompTIA Step 6 ensures system protection is restored only after infection removal is confirmed.
5
Educate the end user.
Reduces the likelihood of repeated infection through social engineering vectors.
CompTIA Step 7 completes the standard malware removal workflow.

Key Concept

CompTIA 7-Step Malware Removal Process
Estimated Time:1m 15s
Rate this question

Topics

Malware Symptoms and Standard Removal Procedures

More questions from this topic