A field service technician at a regional weather forecasting station is troubleshooting a Windows 11 workstation used for real-time radar telemetry processing. The workstation exhibits symptoms of a malware infection, including persistent rogue system pop-up warnings, redirected search engine results, and heavy unauthorized background network traffic. Which TWO of the following initial actions should the technician perform to contain the threat and prepare the workstation prior to running malware remediation scans?
- Disconnect all physical Ethernet cables and disable all wireless network adapters on the workstation.Answer
- Disable the Windows System Restore feature on all local disk volumes.Answer
- CRoll back the operating system to an earlier restore point using Windows System Restore.
- DReplace the system's network interface card assuming high bandwidth usage indicates a hardware controller failure.
Answer
The technician should disconnect all physical network connections and wireless adapters to quarantine the host, and disable Windows System Restore to prevent malware from persisting in Volume Shadow Copies.
According to CompTIA's standard 7-step malware remediation process, once symptoms are identified (Step 1), the immediate next steps are to quarantine the infected system (Step 2) and disable System Restore (Step 3). Disconnecting network interfaces prevents malware from spreading across the local subnet or communicating with external threat actors. Disabling System Restore deletes existing shadow copies, ensuring malware cannot persist inside restore points during remediation.
Step-by-Step Solution
Key Concept
CompTIA 7-Step Malware Removal Procedure (Quarantine and System Restore Management)
Estimated Time:1m 30s