Examkin

Question

Difficulty: HardMalware Symptoms and Standard Removal Procedures

An IT technician is dispatched to handle a Windows 11 self-service airport check-in kiosk exhibiting malware symptoms, including unauthorized background network connections and browser redirects. Arrange the following remediation procedures in the correct sequential order according to the official CompTIA 7-step malware removal workflow, starting from the earliest step to be performed.

  1. 1Disconnect the kiosk's physical Ethernet link and disable its Wi-Fi connection.
  2. 2Turn off Windows System Protection to clear existing recovery points.
  3. 3Boot the operating system into Safe Mode to execute standalone remediation tools and remove malicious files.
  4. 4Set up automated daily background antimalware scans and verify OS update installations.
  5. 5Re-enable Windows System Protection and generate a clean baseline snapshot.

Answer

The correct order follows CompTIA's 7-step malware removal process: 1. Disconnect network interfaces (Isolate), 2. Turn off System Protection (Disable System Restore), 3. Boot into Safe Mode and run remediation tools (Remediate), 4. Configure automated scans and OS updates (Schedule scans/updates), and 5. Re-enable System Protection and create a fresh restore point (Enable System Restore).
The correct sequence strictly follows the CompTIA 7-step malware remediation procedure. The technician must first isolate the system by disconnecting network interfaces (Step 2), disable System Restore to purge infected points (Step 3), remediate the system in Safe Mode (Step 4), schedule recurring scans and install updates (Step 5), and finally re-enable System Restore to establish a clean restore point (Step 6).

Step-by-Step Solution

1
Isolate the infected device
Disconnecting network interfaces prevents C2 communication and lateral network movement.
Isolation is Step 2 of the CompTIA 7-step process, performed immediately after identifying symptoms.
2
Disable System Restore / System Protection
Prevents the OS from creating backups containing malware files and purges infected legacy restore points.
Disabling System Restore is Step 3 of the process, required before active scanning and removal.
3
Remediate infected systems
Removes malicious files and registry keys while operating in a minimal environment like Safe Mode.
Remediation is Step 4 of the process.
4
Schedule scans and update security software
Ensures antimalware signatures are current and sets up ongoing prevention mechanisms.
Scheduling scans and updating software is Step 5 of the process.
5
Enable System Restore and create a restore point
Restores system backup functionality and creates a confirmed clean state recovery point.
Re-enabling restore features is Step 6 of the process, performed only after verification of complete remediation.

Key Concept

CompTIA 7-Step Malware Removal Procedure
Rate this question

Topics

Malware Symptoms and Standard Removal Procedures

More questions from this topic