Examkin

Question

Difficulty: Very hardMalware Symptoms and Standard Removal Procedures

A systems administrator detects active ransomware activity on a master workstation controlling live digital media encoding streams in a television broadcasting studio. Following the standard CompTIA 7-step malware removal process, in what precise chronological sequence should the administrator perform the following remediation steps?

  1. 1Disconnect all physical Ethernet cables and disable all wireless network interfaces on the broadcasting workstation.
  2. 2Turn off Windows System Restore and purge all existing system restore points.
  3. 3Boot the system into Safe Mode, install the latest signature files via a write-protected USB flash drive, and execute a comprehensive anti-malware scan.
  4. 4Re-enable Windows System Restore and construct a fresh, uncorrupted system restore baseline point.
  5. 5Conduct an interactive security awareness training session with the studio broadcast engineers on recognizing spear-phishing attack vectors.

Answer

The proper sequence follows the CompTIA 7-step malware removal methodology: First, isolate the system by disconnecting network interfaces; second, disable System Restore and delete previous restore points; third, remediate the workstation by updating definitions offline and scanning in Safe Mode; fourth, re-enable System Restore and generate a clean restore point; fifth, educate the end user on security best practices.
CompTIA mandates a strict 7-step malware removal process: 1. Identify malware symptoms, 2. Isolate infected systems, 3. Disable System Restore, 4. Remediate infected systems (update anti-malware and scan), 5. Schedule scans and run updates, 6. Enable System Restore and create a restore point, and 7. Educate end user. Network isolation must precede all remediation to halt lateral propagation. Disabling System Restore deletes infected recovery snapshots. Remediating eradicates the active infection. System Restore is re-enabled only when the system is verified clean, followed finally by user education.

Step-by-Step Solution

1
Isolate the infected workstation by disconnecting all wired and wireless network interfaces.
Prevents ransomware from communicating with command-and-control servers or spreading across network shares.
System isolation is Step 2 of CompTIA's process and must occur immediately after threat identification.
2
Disable Windows System Restore and delete existing restore snapshots.
Eliminates malware persistence mechanisms embedded in volume shadow copies.
Disabling System Restore is Step 3, preventing the system from automatically backing up infected files.
3
Boot into Safe Mode, apply offline anti-malware updates, and complete a full system scan.
Detects and quarantines active ransomware binaries and startup entries without active network reinfection.
System remediation is Step 4, using updated tools in a minimal environment to clear threats.
4
Turn System Restore back on and manually build a new clean system restore point.
Restores OS protection functionality with a confirmed malware-free recovery point.
Enabling System Restore is Step 6 and must strictly take place after successful scan remediation.
5
Provide targeted security awareness training to the broadcast engineer.
Improves user vigilance against social engineering, malicious email links, and drive-by downloads.
End-user education is Step 7, completing the malware remediation workflow.

Key Concept

CompTIA 7-Step Malware Removal Best Practices
Rate this question

Topics

Malware Symptoms and Standard Removal Procedures

More questions from this topic