Examkin

Question

Difficulty: Very hardMalware Symptoms and Standard Removal Procedures

A cybersecurity technician is responding to a compromised Windows 11 enterprise workstation exhibiting unauthorized network beaconing and modified system files. Arrange the following technician actions in the correct chronological sequence mandated by the official CompTIA 7-step malware removal procedure, starting with the earliest action.

  1. 1Disconnect the physical Ethernet cable and disable wireless network interfaces to quarantine the workstation.
  2. 2Turn off Windows System Protection to purge all existing restore points containing potentially hidden malware payloads.
  3. 3Download the latest anti-malware signatures on an uncompromised system and execute a comprehensive remediation scan in an isolated environment.
  4. 4Configure operating system automatic updates and schedule recurring daily background anti-malware scans.
  5. 5Re-enable Windows System Protection and manually generate a clean, uncompromised restore point.

Answer

The correct order follows CompTIA's standard 7-step malware removal protocol: 1) Quarantine the endpoint by disconnecting network interfaces (Isolate), 2) Turn off System Protection (Disable System Restore), 3) Update signature files and perform a full scan (Remediate), 4) Enable automatic OS updates and schedule regular scans (Schedule scans and updates), and 5) Turn System Protection back on and generate a clean restore point (Enable System Restore).
The correct sequence directly adheres to CompTIA's official 7-step malware removal process: Step 2 requires isolating the infected device (disconnecting Ethernet and Wi-Fi) to contain the threat. Step 3 requires disabling System Restore to clear infected restore points. Step 4 encompasses remediating the system by updating anti-malware signatures and executing scans. Step 5 involves scheduling automated scans and applying OS updates. Step 6 involves re-enabling System Restore and generating a new, known-good restore point.

Step-by-Step Solution

1
Isolate the compromised system.
Prevents active malware from spreading laterally across the enterprise network or communicating with command-and-control servers.
System isolation is Step 2 and must occur immediately after malware symptoms are recognized.
2
Disable System Restore / System Protection.
Deletes stored restore points that could retain copy-protected malicious binaries.
Step 3 prevents accidental system reinfection during or after the remediation phase.
3
Remediate the infected environment.
Anti-malware definitions are updated offline or via safe methods, and malicious software is successfully purged.
Step 4 focuses on active eradication using updated software and dedicated removal tools.
4
Schedule scans and install OS/application updates.
Patches system vulnerabilities and establishes ongoing automated monitoring to prevent reinfection.
Step 5 ensures long-term system integrity once active threats have been eradicated.
5
Enable System Restore and create a clean restore point.
Establishes a verified, uninfected recovery baseline for future troubleshooting.
Step 6 must only occur after confirming the system is patched, clean, and fully operational.

Key Concept

CompTIA 7-Step Malware Removal Procedure
Rate this question

Topics

Malware Symptoms and Standard Removal Procedures

More questions from this topic