Examkin

Question

Difficulty: HardMalware Detection, Removal, and Prevention

A cybersecurity analyst at a healthcare organization isolates an infected Windows endpoint by disconnecting its network interface and disabling all wireless radios following detection of active spyware transmission. According to the CompTIA standard 7-step malware remediation process, which TWO actions must the analyst perform NEXT immediately prior to running a full system scan? (Select TWO.)

  1. Disable System Restore on all system drivesAnswer
  2. Update the anti-malware signature definitionsAnswer
  3. C
    Create a new System Restore point to back up system state
  4. D
    Execute the sfc /scannow command to replace modified system files

Answer

The analyst must disable System Restore on all system drives and update the anti-malware signature definitions before conducting the remediation scan.
In the standard CompTIA 7-step malware remediation methodology (1. Identify, 2. Quarantine, 3. Disable System Restore, 4. Remediate, 5. Schedule scans, 6. Enable System Restore/Create restore point, 7. Educate user), once quarantine is accomplished, the technician must disable System Restore and update antimalware signature definitions before running the remediation scan.

Step-by-Step Solution

1
Analyze the current stage in the CompTIA 7-step malware remediation process
The scenario states that symptoms were identified (Step 1) and the system has already been quarantined (Step 2).
Determining the completed steps establishes what must happen next in the standardized workflow.
2
Identify the next sequential step in the process
Step 3 requires disabling System Restore to prevent infected files from being saved or backed up during clean-up.
If System Restore remains enabled, malicious code can persist within restore snapshots.
3
Identify the initial action required within Step 4 (Remediate infected systems)
Step 4a mandates updating anti-malware software and signature definitions prior to executing the actual system scan (Step 4b).
Scanning with outdated definitions can cause the anti-malware scanner to miss newly identified variants of spyware.

Key Concept

CompTIA 7-Step Malware Remediation Order
Estimated Time:2m 0s
Rate this question

Topics

Malware Detection, Removal, and Prevention

More questions from this topic