Examkin

Question

Difficulty: MediumMalware Detection, Removal, and Prevention

An IT technician at a television broadcast studio is responding to a Windows workstation used for live news graphics that is displaying unauthorized pop-up advertisements and experiencing severe system slowdowns. The technician confirmed the presence of malware and unplugged the Ethernet cable to isolate the machine. According to the standard CompTIA 7-step malware remediation process, which action should the technician take NEXT?

  1. Disable System Restore in Windows.Answer
  2. B
    Update the anti-malware definitions and perform a full system scan.
  3. C
    Schedule automatic anti-malware scans and OS updates.
  4. D
    Execute the sfc /scannow command from an elevated command prompt.

Answer

Disable System Restore in Windows.
According to the official CompTIA 7-step malware remediation process, once the system is quarantined (Step 2), the technician must disable System Restore (Step 3) before attempting remediation. This prevents Windows from creating shadow copies or restore points containing the active infection.

Step-by-Step Solution

1
Identify current progress in the CompTIA 7-step malware remediation process.
Step 1 (Identify malware symptoms) and Step 2 (Quarantine the infected system) are already complete.
The technician confirmed symptoms and disconnected the device from the network.
2
Determine the next sequential step in the process.
Step 3 is to disable System Restore.
Disabling System Restore ensures that clean points are not overwritten with malware-infected backups during removal efforts.

Key Concept

CompTIA 7-Step Malware Remediation Process
Rate this question

Topics

Malware Detection, Removal, and Prevention

More questions from this topic