Examkin

Question

Difficulty: Very hardMalware Detection, Removal, and Prevention

A tier-2 desktop support technician is responding to an automated incident response alert on a Windows 11 domain-joined endpoint. The host machine is actively attempting unauthorized SMB connections to network shares and writing encrypted file headers across connected volumes. According to standard CompTIA malware remediation procedures, which of the following actions must the technician execute FIRST to properly contain the outbreak and prepare the operating system for remediation? (Select TWO.)

  1. Disconnect all physical Ethernet cabling and disable active wireless network adapters on the endpoint.Answer
  2. Turn off System Protection and delete existing restore points on the infected system.Answer
  3. C
    Execute sfc /scannow from an elevated command prompt to repair modified system DLL files before isolating the system.
  4. D
    Generate a fresh System Restore point and Windows System Image backup prior to starting cleanup.
  5. E
    Restart the host machine into Safe Mode with Networking to download updated signature files directly from the cloud vendor.

Answer

The technician must immediately quarantine the system by disabling all network interfaces and disable System Restore to purge infected restore points before initiating remediation.
Following symptom identification, the standard CompTIA malware remediation process dictates that technicians must first quarantine infected systems by disconnecting all network interfaces (Ethernet/Wi-Fi) to prevent lateral spread, and subsequently disable System Restore (System Protection) to clear volume shadow copies that may store malware files.

Step-by-Step Solution

1
Identify symptoms and verify active threat containment requirements
The host exhibits ransomware behavior, propagating across SMB and encrypting data.
Immediate action must follow the CompTIA 7-step remediation framework starting after identification.
2
Quarantine the infected system (Step 2)
Disconnecting Ethernet cables and disabling Wi-Fi cuts off command-and-control access and halts lateral spread across network shares.
Preventing lateral movement to corporate assets is the immediate priority during an active ransomware outbreak.
3
Disable System Restore (Step 3)
Turning off System Protection purges existing restore points containing infected files and prevents automatic reinfection.
If System Restore is left enabled, malware stored inside shadow volumes can reinstall itself post-remediation.

Key Concept

CompTIA 7-Step Malware Remediation Process (Step 2: Quarantine & Step 3: Disable System Restore)
Rate this question

Topics

Malware Detection, Removal, and Prevention

More questions from this topic