A systems technician is servicing a Windows 11 Enterprise workstation controlling an automated warehouse sorting line. The system displays unusual pop-up advertisements, background network latency spikes, and unauthorized registry modifications. The technician has physically disconnected the network cable and disabled all wireless interfaces to isolate the machine. Which TWO of the following tasks must the technician perform NEXT before initiating the full system antimalware scan?
- Turn off System Protection (System Restore) to prevent malicious files from being preserved in restore points.Answer
- Obtain updated antimalware definition files using a known-clean machine and transfer them to the isolated system via write-protected media.Answer
- CRe-enable System Protection and manually generate a new system restore point to establish a baseline snapshot.
- DConduct security awareness training with the warehouse operators on identifying malicious email attachments and drive-by downloads.
Answer
The technician must turn off System Protection (System Restore) and obtain updated antimalware definition files via clean offline media prior to running the antimalware scan.
Following isolation (Step 2), the technician must proceed sequentially to Step 3 (Disable System Restore) so that infected files are not preserved in system restore points. Next, as part of Step 4 (Remediate infected systems), the technician must update antimalware signature files (Step 4a) using offline media before running scans (Step 4b) on the network-isolated machine.
Step-by-Step Solution
Key Concept
CompTIA 7-Step Malware Removal Procedure