Examkin

Question

Difficulty: HardMalware Symptoms and Standard Removal Procedures

An IT technician is responding to a confirmed malware infection on a Windows 11 workstation operating inside a pharmaceutical cleanroom environment. The technician has already identified the symptoms and isolated the workstation from the facility network by disconnecting its Ethernet cable. According to standard CompTIA malware removal procedures, which of the following actions should the technician perform NEXT before initiating full antimalware scanning and remediation? (Select TWO.)

  1. Disable System Protection (System Restore) on the affected system.Answer
  2. Obtain the latest antimalware definition files using a clean computer and transfer them to the isolated system.Answer
  3. C
    Create an immediate system restore point to preserve system configuration settings before attempting cleanup.
  4. D
    Temporarily reconnect the network cable to allow the antimalware tool to pull live updates from cloud servers.
  5. E
    Provide immediate end-user security awareness training to the cleanroom operators regarding safe browsing.

Answer

The technician should disable System Protection (System Restore) and obtain updated antimalware definitions using an uninfected computer via offline media.
According to CompTIA standard malware remediation procedures, after identifying symptoms (Step 1) and isolating the system (Step 2), the technician must disable System Restore (Step 3) to prevent infected files from being saved into backup restore points. Next, as part of remediation (Step 4), the technician must update antimalware definitions; since the device is isolated, definitions should be downloaded on an uninfected machine and transferred offline.

Step-by-Step Solution

1
Identify the current stage within the CompTIA 7-step malware removal model.
The technician has completed Step 1 (Identify malware symptoms) and Step 2 (Isolate infected system).
Establishing what has already been accomplished clarifies which steps must follow in sequence.
2
Determine Step 3 of the malware removal procedure.
Step 3 requires disabling System Restore in Windows.
This prevents malicious binaries from being stored in shadow copies or system restore points during remediation.
3
Determine the initial phase of Step 4 (Remediate infected systems).
Step 4a requires updating antimalware software definitions.
Because the system is isolated from the network, definition files must be retrieved on an uninfected system and transferred via removable media to maintain isolation prior to scanning.

Key Concept

CompTIA 7-Step Malware Remediation Workflow (Steps 3 and 4a)
Rate this question

Topics

Malware Symptoms and Standard Removal Procedures

More questions from this topic