Examkin

Question

Difficulty: MediumMalware Detection, Removal, and Prevention

A network support technician at a municipal utility company is responding to a Windows 10 desktop infected with rogue adware and browser hijacking tools. Place the standard CompTIA malware remediation steps in the correct sequential order from first to last to properly resolve this incident.

  1. 1Quarantine the infected desktop by disconnecting network cables and disabling wireless adapters.
  2. 2Disable System Restore in Windows to clear existing restore points containing infected files.
  3. 3Update anti-malware signatures and run a full system scan to remediate the infection.
  4. 4Enable System Restore and create a new, clean system restore point.
  5. 5Educate the end user on identifying suspicious web links and avoiding rogue browser add-ons.

Answer

The correct sequence follows the CompTIA 7-step malware removal process: 1. Quarantine the infected desktop by disconnecting network cables and disabling wireless adapters; 2. Disable System Restore in Windows to clear existing restore points containing infected files; 3. Update anti-malware signatures and run a full system scan to remediate the infection; 4. Enable System Restore and create a new, clean system restore point; 5. Educate the end user on identifying suspicious web links and avoiding rogue browser add-ons.
The correct order follows CompTIA's established best practices for malware remediation: first isolate the system (Quarantine), then prevent reinfection via restore points (Disable System Restore), eliminate the threat (Remediate by updating definitions and scanning), restore recovery functionality (Enable System Restore and create a restore point), and finally prevent recurrences (Educate end user).

Step-by-Step Solution

1
Quarantine the infected system from the local network environment.
Network cables are unplugged and wireless connectivity is turned off.
Prevents the adware/hijacker from communicating with external servers or spreading laterally to other network devices.
2
Disable System Restore in Windows settings.
Existing Windows system restore points containing malicious files are permanently deleted.
Ensures that malware hidden in system restore snapshots cannot be restored after cleanup.
3
Remediate the system by updating anti-malware software definitions and executing a full scan.
The adware components, browser extensions, and unauthorized registry entries are identified and quarantined/removed.
Ensures the scanner has the latest threat signatures to locate and eradicate all components of the malware.
4
Re-enable System Restore and create a clean system restore point.
System protection is restored with a verified malware-free baseline.
Re-establishes recovery capability for the operating system after confirming the infection is completely cleared.
5
Provide security awareness education to the primary workstation user.
The user is trained on recognizing social engineering tactics, drive-by downloads, and malicious browser extensions.
Completes the remediation process by addressing the human vector to prevent future infections.

Key Concept

CompTIA 7-Step Malware Remediation Process
Estimated Time:1m 30s
Rate this question

Topics

Malware Detection, Removal, and Prevention

More questions from this topic