Examkin

Question

Difficulty: MediumMalware Detection, Removal, and Prevention

An IT support specialist at a solar power generation monitoring facility is remediating a Windows 11 workstation infected with rogue spyware. The specialist has already identified the malware symptoms, disconnected the system from the network to isolate it, and disabled System Restore in Windows. According to the standard CompTIA 7-step malware remediation process, which of the following actions should the specialist perform NEXT?

  1. Update the anti-malware software signature definitions using an offline update package.Answer
  2. B
    Schedule recurring automatic anti-malware scans and daily definition updates in Task Scheduler.
  3. C
    Re-enable System Restore and manually generate a clean system restore point.
  4. D
    Run the sfc /scannow command from an elevated Command Prompt to restore modified system binaries.

Answer

Update the anti-malware software signature definitions using an offline update package.
According to CompTIA's official 7-step malware remediation process, once the system is quarantined (Step 2) and System Restore is disabled (Step 3), the technician must remediate the infected system (Step 4). The first part of remediation (Step 4a) is updating the anti-malware software signature files and engine. Because the system was isolated from the network during quarantine, deploying updated definitions via offline media is necessary before launching remediation scans (Step 4b).

Step-by-Step Solution

1
Review the CompTIA 7-step malware remediation framework order.
The steps are: 1. Identify symptoms, 2. Quarantine, 3. Disable System Restore, 4. Remediate (a. Update definitions, b. Scan/remove), 5. Schedule scans/updates, 6. Enable System Restore & create restore point, 7. Educate user.
CompTIA strictly enforces this sequential methodology.
2
Identify the current progress established in the scenario stem.
Steps 1 (Identify), 2 (Quarantine), and 3 (Disable System Restore) have already been completed.
The next action must be Step 4a: Update the anti-malware signatures/engine.
3
Select the option corresponding to Step 4a.
Updating anti-malware signatures using an offline update package is the immediate required step.
Because the machine is quarantined from the network, definition updates must be installed via offline media before scanning.

Key Concept

CompTIA 7-Step Malware Remediation Best Practices
Estimated Time:1m 0s
Rate this question

Topics

Malware Detection, Removal, and Prevention

More questions from this topic