Examkin

Question

Difficulty: Very hardMalware Detection, Removal, and Prevention

A systems engineer is responding to a security incident involving a Windows 11 point-of-sale terminal that was flagged for stealthy spyware behavior. The engineer has identified the infection symptoms and successfully isolated the system by disabling all network interfaces and unplugging physical connections. According to the standard CompTIA 7-step malware remediation process, which action must the engineer perform NEXT prior to updating anti-malware signatures or initiating a scan?

  1. A
    Boot the system into Safe Mode with Networking to run a complete anti-malware scan.
  2. Turn off System Protection to disable System Restore on the endpoint.Answer
  3. C
    Configure Task Scheduler to run recurring anti-malware scans and apply operating system updates.
  4. D
    Execute `sfc /scannow` from an elevated command prompt to fix corrupted system binaries.

Answer

Turn off System Protection to disable System Restore on the endpoint.
The CompTIA 7-step malware remediation process strictly follows this sequence: 1. Identify malware symptoms, 2. Quarantine infected systems, 3. Disable System Restore (in Windows), 4. Remediate infected systems (update anti-malware / scan and remove), 5. Schedule scans and run updates, 6. Enable System Restore and create a restore point, 7. Educate the end user. Since the scenario states that symptoms have been identified (Step 1) and the system has been isolated/quarantined (Step 2), the immediate next step is Step 3: disabling System Restore.

Step-by-Step Solution

1
Analyze current progress in the CompTIA 7-step malware remediation framework.
Step 1 (Identify malware symptoms) and Step 2 (Quarantine infected systems) have already been performed.
Determining the current state in the sequential process establishes what comes immediately next.
2
Identify the mandatory third step in the remediation process.
Step 3 requires disabling System Restore in Windows.
Disabling System Restore ensures that clean system files are not overwritten by malware during remediation and prevents infected restore points from reinfecting the machine.
3
Select the option that matches Step 3.
Turning off System Protection disables System Restore.
This step must take place before Step 4 (remediation, definition updates, and scanning).

Key Concept

CompTIA 7-Step Malware Remediation Process
Rate this question

Topics

Malware Detection, Removal, and Prevention

More questions from this topic