Examkin

Question

Difficulty: EasyMalware Symptoms and Standard Removal Procedures

An IT support specialist is working on a compromised Windows point-of-sale workstation. Before running anti-malware remediation tools to clean the system, which TWO of the following pre-scan procedures must be completed according to the standard CompTIA malware removal steps?

  1. Isolate the system from the network by disconnecting wired and wireless network connectionsAnswer
  2. Disable System Restore in the operating systemAnswer
  3. C
    Create a new System Restore point to preserve current system configurations
  4. D
    Conduct end-user training on how to avoid phishing links and untrusted downloads

Answer

The correct pre-scan procedures are isolating the system from the network and disabling System Restore.
According to the CompTIA 7-step malware removal methodology, after identifying symptoms, the technician must isolate the infected system by disconnecting network links to halt potential malware spread and command-and-control communication. Following isolation, the technician must disable System Restore to delete infected restore points before running remediation tools.

Step-by-Step Solution

1
Identify the proper sequence of pre-remediation steps in the standard CompTIA 7-step malware removal process.
The initial steps in order are: 1. Identify symptoms, 2. Isolate infected systems, 3. Disable System Restore, 4. Remediate infected systems.
Isolation and disabling System Restore must occur before any scanning or cleaning phase begins.
2
Select the actions that correspond to isolating the computer and handling restore points.
Disconnecting network cables/Wi-Fi isolates the machine, while disabling System Restore clears infected shadow copies.
Scanning an unisolated machine risks network propagation, and leaving System Restore active risks reinfection from backed-up shadow copies.

Key Concept

CompTIA 7-Step Malware Removal Procedure - Isolation and System Restore Management
Rate this question

Topics

Malware Symptoms and Standard Removal Procedures

More questions from this topic