Examkin

Question

Difficulty: HardMalware Detection, Removal, and Prevention

A desktop support technician receives an escalated ticket regarding a corporate Windows workstation exhibiting persistent rogue security software pop-ups. The field technician assigned to the ticket has already confirmed the infection symptoms and disconnected the machine from the corporate network to enforce quarantine. According to the standard CompTIA malware remediation process, which of the following actions should the technician perform NEXT prior to executing malware scanning and removal tools?

  1. Disable System Protection/System Restore on the workstation.Answer
  2. B
    Reconnect the network adapter to download the latest anti-malware definition updates.
  3. C
    Run the sfc /scannow command from an elevated Command Prompt to repair system files.
  4. D
    Create a manual System Restore point to preserve system configuration state before scanning.

Answer

Disable System Protection/System Restore on the workstation.
According to the official CompTIA 7-step malware remediation workflow (1. Identify symptoms, 2. Quarantine system, 3. Disable System Restore, 4. Remediate infected systems, 5. Schedule updates/boot environment, 6. Enable System Restore & create restore point, 7. Educate end user), after identifying and quarantining the host, the immediate next action is to disable System Restore. Turning off System Restore purges prior restore points that may contain malware copies and prevents new restore points from caching malicious files during cleanup.

Step-by-Step Solution

1
Review the current state within the CompTIA 7-step malware remediation process.
Step 1 (Identify malware symptoms) and Step 2 (Quarantine infected systems) have already been completed by the field technician.
Determines the correct sequential placement within the standard remediation workflow.
2
Identify Step 3 of the CompTIA 7-step malware remediation process.
Step 3 requires disabling System Restore (System Protection) in Windows.
Prevents the operating system from creating automated restore points that include malware or allowing malicious software to persist within existing shadow copies.
3
Verify that remediation and scanning (Step 4) follow Step 3.
Once System Restore is turned off and existing restore points are purged, malware scanning tools can safely be executed.
Ensures complete eradication without leaving hidden infected restore points on disk.

Key Concept

CompTIA 7-Step Malware Remediation Process
Rate this question

Topics

Malware Detection, Removal, and Prevention

More questions from this topic