Examkin

Question

Difficulty: MediumMalware Symptoms and Standard Removal Procedures

A desktop technician at a tax advisory firm is responding to a Windows 11 workstation displaying rogue security pop-ups and redirected web searches. The technician has confirmed the presence of malware. Following the standard CompTIA 7-step malware remediation process, which of the following actions should the technician take PRIOR to initiating anti-malware scans and system remediation? (Select TWO).

  1. Disconnect the workstation from both wired Ethernet and wireless networks.Answer
  2. Disable Windows System Restore to purge existing system restore points.Answer
  3. C
    Create a new System Restore point to back up system settings before cleaning.
  4. D
    Keep the system connected to a guest network to download live antivirus definition updates.

Answer

Disconnect the workstation from both wired Ethernet and wireless networks, and disable Windows System Restore to purge existing restore points.
According to the official CompTIA 7-step malware removal process, after identifying malware symptoms (Step 1), the technician must isolate the infected machine from all network connections (Step 2) and disable System Restore in Windows (Step 3) prior to running anti-malware scans and remediation tools (Step 4). Disconnecting all network interfaces stops lateral movement and external communication. Disabling System Restore purges saved restore points that could hold infected copies of files.

Step-by-Step Solution

1
Determine current step within the CompTIA 7-step malware remediation workflow.
Malware symptoms have already been identified (Step 1). The next mandatory steps before remediation (Step 4) are Isolation (Step 2) and Disabling System Restore (Step 3).
CompTIA defines standard remediation order as: 1. Identify, 2. Isolate, 3. Disable System Restore, 4. Remediate (update signatures & scan), 5. Schedule scans/updates, 6. Enable System Restore & create restore point, 7. Educate end user.
2
Perform system isolation.
Unplug the network cable and turn off Wi-Fi/Bluetooth connections.
Containment stops network propagation and command-and-control channel traffic.
3
Disable System Restore in Windows.
All restore points containing malware snapshots are removed.
Ensures infected files cannot be restored later by System Restore.

Key Concept

CompTIA 7-Step Malware Remediation Procedure
Rate this question

Topics

Malware Symptoms and Standard Removal Procedures

More questions from this topic