Examkin

Question

Difficulty: HardMalware Symptoms and Standard Removal Procedures

A cybersecurity technician is dispatched to address a suspected malware outbreak on several Windows workstations controlling automated sorting equipment in a pharmaceutical distribution center. The systems are exhibiting severe performance degradation, unusual background network traffic, and rogue process executions. To strictly adhere to the standard CompTIA 7-step malware removal procedure, which of the following preliminary steps MUST be completed before executing anti-malware remediation scans on these systems? (Select TWO.)

  1. Disconnect all physical network cables and disable wireless adapters on the infected workstations.Answer
  2. Disable System Protection on the Windows operating system to prevent malicious files from being saved in restore points.Answer
  3. C
    Immediately generate a fresh System Restore point to capture the operating system state before performing removal procedures.
  4. D
    Execute an immediate full anti-malware system scan while maintaining active network connectivity for real-time cloud definitions.

Answer

The technician must isolate the infected workstations from the network by disconnecting network interfaces and disable System Protection (System Restore) prior to running anti-malware remediation scans.
According to the official CompTIA 7-step malware remediation process, once symptoms are identified (Step 1), the technician must immediately isolate infected systems (Step 2) by disconnecting network interfaces. Following isolation, System Restore/System Protection must be disabled (Step 3) to clear existing restore points containing infected files before moving to remediation (Step 4). Therefore, isolating network connections and disabling System Protection are the two essential preliminary steps.

Step-by-Step Solution

1
Identify the symptoms of infection
Confirmed malware activity on the pharmaceutical distribution workstations (Step 1).
Establishing that malware is present initiates the 7-step remediation workflow.
2
Isolate the infected systems
Physical network cables are unplugged and Wi-Fi/Bluetooth adapters are disabled (Step 2).
Prevents lateral movement across the network and cuts off command-and-control server communication.
3
Disable System Restore / System Protection
System Protection is turned off, purging all existing restore points (Step 3).
Ensures infected restore points are removed so malware cannot survive or be restored post-cleanup.
4
Proceed to system remediation
The system is now prepared for anti-malware definition updates and full remediation scans (Step 4).
Remediation can safely occur only after isolation and restore point purging.

Key Concept

CompTIA 7-Step Malware Removal Procedure (Isolation & System Restore Disabling)
Rate this question

Topics

Malware Symptoms and Standard Removal Procedures

More questions from this topic