Examkin

Question

Difficulty: HardMalware Symptoms and Standard Removal Procedures

A network administrator suspects that a domain controller housed in a branch office has been infected with spyware after detecting unusual outgoing traffic patterns and unauthorized registry modifications. To ensure complete remediation following CompTIA's standard best practices, in what precise order should the administrator perform the following post-isolation actions?

  1. 1Disable System Restore in Windows.
  2. 2Update anti-malware signatures and perform a full system scan to remove the spyware.
  3. 3Schedule recurring anti-malware scans and verify automatic OS updates are enabled.
  4. 4Enable System Restore and create a clean restore point.
  5. 5Conduct security awareness training for the local site administrators.

Answer

The correct order of procedures is: Disable System Restore in Windows -> Update anti-malware signatures and perform a full system scan -> Schedule recurring anti-malware scans and verify automatic OS updates -> Enable System Restore and create a clean restore point -> Conduct security awareness training.
According to CompTIA's official 7-step malware removal process, after identifying the malware symptoms (Step 1) and isolating the system (Step 2), the technician must disable System Restore (Step 3) to prevent malicious files from persisting in restore points. Next comes remediation (Step 4), which includes updating signatures and executing scans. After remediation, the technician schedules regular scans and OS updates (Step 5), re-enables System Restore and creates a clean restore point (Step 6), and finally educates the end user (Step 7).

Step-by-Step Solution

1
Disable System Restore in Windows
Prevents infected files from being preserved in restore points.
If System Restore remains active, anti-malware utilities cannot purge malicious files held within protected system restore points.
2
Remediate infected systems (Update anti-malware software & scan/remove)
Purges active malware components from disk and memory.
Anti-malware definitions must be updated prior to running a full system scan to detect the latest threat signatures.
3
Schedule scans and run updates
Ensures proactive continuous protection and OS patching.
Automating anti-malware scans and system updates hardens the system against re-infection.
4
Enable System Restore and create a restore point
Establishes a clean recovery baseline.
System Restore must only be re-enabled after verifying the system is entirely clear of infection to avoid backing up malware.
5
Educate the end user
Mitigates operational security risks.
Providing security awareness training completes the 7-step remediation framework by addressing human risk factors.

Key Concept

CompTIA 7-Step Malware Removal Procedure Sequence
Rate this question

Topics

Malware Symptoms and Standard Removal Procedures

More questions from this topic