Examkin

Question

Difficulty: MediumMalware Detection, Removal, and Prevention

A technician is responding to a malware incident on a workstation at a community medical clinic. The system is showing pop-up warnings and redirecting browser traffic. Place the following remediation actions in the correct sequential order according to the standard CompTIA 7-step malware removal process.

  1. 1Quarantine the infected system by disconnecting it from the network.
  2. 2Disable System Restore in Windows to prevent saving infected recovery points.
  3. 3Update anti-malware signatures and execute a full system scan.
  4. 4Re-enable System Restore and create a clean restore point.
  5. 5Educate the end user on safe web browsing and threat awareness.

Answer

The correct order follows the standard CompTIA 7-step malware removal methodology: 1) Quarantine the infected system, 2) Disable System Restore, 3) Update anti-malware signatures and scan, 4) Re-enable System Restore and create a restore point, and 5) Educate the end user.
The CompTIA standard 7-step malware removal process follows a specific logical sequence: 1) Identify symptoms, 2) Quarantine system, 3) Disable System Restore, 4) Remediate infected systems (update definitions and scan), 5) Schedule updates and scans, 6) Enable System Restore and create restore point, and 7) Educate end user. The items provided map directly to steps 2, 3, 4, 6, and 7 in exact chronological order.

Step-by-Step Solution

1
Isolate the compromised system from the local environment.
Network communication is terminated, preventing malware spread.
Quarantine (Step 2) must occur before modifying system settings or performing scans.
2
Disable System Restore.
Existing restore points containing malicious files are cleared and new automatic restore points are suspended.
Disabling System Restore (Step 3) ensures malware cannot persist in Windows system restore points.
3
Remediate the infected system.
Anti-malware signatures are updated and malicious payloads are detected and removed.
Updating definitions and scanning (Step 4) removes the active infection from the machine.
4
Re-enable System Restore and create a clean restore point.
System protection is restored using a clean state baseline.
Re-enabling System Restore (Step 6) guarantees future recovery options without reintroducing cleared malware.
5
Conduct end-user training.
The user is informed about security best practices.
End-user education (Step 7) completes the workflow to help prevent future infections.

Key Concept

CompTIA 7-Step Malware Removal Process
Rate this question

Topics

Malware Detection, Removal, and Prevention

More questions from this topic