Examkin

Question

Difficulty: Very hardMalware Symptoms and Standard Removal Procedures

A systems administrator is responding to an alert on a standalone Windows point-of-sale terminal that is exhibiting unauthorized background network connections and altered registry run keys. The administrator has verified the malware infection and immediately unplugged the network cable to isolate the workstation. According to CompTIA's standard 7-step malware removal procedures, which of the following actions should the administrator perform NEXT?

  1. Disable System Restore and delete all existing restore points on the infected workstation.Answer
  2. B
    Update the local anti-malware signature file via external storage and execute a comprehensive remediation scan.
  3. C
    Reconnect the endpoint to an isolated management VLAN to enable remote anti-malware updates and centralized monitoring.
  4. D
    Open Event Viewer to review the Security log for unauthorized authentication attempts and document the incident.

Answer

Disable System Restore and delete all existing restore points on the infected workstation.
The official CompTIA 7-step malware removal process follows this exact order: 1. Identify malware symptoms, 2. Isolate infected systems, 3. Disable System Restore (in Windows), 4. Remediate infected systems (update anti-malware / scan and remove), 5. Schedule scans and run updates, 6. Enable System Restore and create a restore point, 7. Educate the end user. Since the scenario explicitly confirms that identification and isolation have taken place, the administrator must immediately disable System Restore to purge infected restore points.

Step-by-Step Solution

1
Review the scenario to identify the current step reached in the CompTIA 7-step malware removal process.
Malware symptoms have been identified (Step 1) and the workstation has been isolated from the network (Step 2).
The scenario explicitly establishes that identification and isolation are complete.
2
Determine the mandatory next step in the standard 7-step malware removal workflow.
Step 3 requires disabling System Restore (System Protection in Windows).
Disabling System Restore prevents infected system files stored within restore points/Volume Shadow Copies from being used to restore the machine or reinfecting it later.
3
Select the option that strictly corresponds to Step 3 of the CompTIA methodology.
Disabling System Restore and deleting existing restore points is the correct next action.
Remediation (scans/updates), scheduling, re-enabling System Restore, and end-user education must strictly follow in subsequent steps.

Key Concept

CompTIA 7-Step Malware Removal Procedure Sequence
Rate this question

Topics

Malware Symptoms and Standard Removal Procedures

More questions from this topic