Examkin

Question

Difficulty: MediumMalware Symptoms and Standard Removal Procedures

A cybersecurity technician is responding to a malware infection on a computer at a municipal water utility facility. Arrange the following remediation actions in the correct order according to CompTIA's standard 7-step malware removal procedure, from first action to last action.

  1. 1Disconnect the workstation from the local ethernet network and disable all wireless network interfaces.
  2. 2Disable Windows System Restore to clear existing restore points.
  3. 3Update anti-malware signature definitions and run a full system scan to remove infected files.
  4. 4Re-enable Windows System Restore and generate a new, clean restore point.
  5. 5Conduct security awareness training with the end user regarding safe browsing and email security.

Answer

The correct sequential order follows the CompTIA 7-step malware removal framework: (1) Disconnect network cabling and wireless connections to isolate the system, (2) Disable Windows System Restore, (3) Update anti-malware signatures and perform full system remediation scans, (4) Re-enable System Restore and create a clean restore point, and (5) Educate the end user on security awareness.
The correct order adheres strictly to CompTIA's 7-step remediation framework: Isolate system (Step 2) -> Disable System Restore (Step 3) -> Remediate system via signature updates and scans (Step 4) -> Re-enable System Restore and create a clean restore point (Step 6) -> Educate end user (Step 7).

Step-by-Step Solution

1
Isolate the infected system
Network cables are unplugged and Wi-Fi interfaces are disabled.
Prevents lateral movement of malware across the organization's network.
2
Disable System Restore in Windows
System Restore is turned off and past restore points containing malicious code are purged.
Ensures that malware cannot persist within Windows system backups.
3
Remediate infected system
Anti-malware software definitions are updated to the latest release and a full system scan removes infected files.
Clears active malicious processes and files from the operating system.
4
Enable System Restore and create a new restore point
System Restore service is re-enabled and a fresh baseline snapshot is captured.
Establishes a clean, known-good recovery point for future use.
5
Educate the end user
The user receives guidance on avoiding phishing emails, rogue software, and risky downloads.
Addresses the human factor to prevent future security incidents.

Key Concept

CompTIA 7-Step Malware Removal Procedure
Rate this question

Topics

Malware Symptoms and Standard Removal Procedures

More questions from this topic