Examkin

All practice questions

423 questions

All types3,551Multiple choice1,809Multiple select786Numeric12Matching521Ordering423
Question 341Question →

A desktop technician is following standard CompTIA procedures to remediate a malware infection on an enterprise workstation. Arrange the following steps of the malware removal process in the correct order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of the malware remediation procedure is: Disconnect the infected workstation from the network, Disable System Restore in Windows, Run anti-malware scans and removal tools to clean the system, and Enable System Restore and create a new restore point.
Under standard CompTIA malware removal procedures, the technician must first isolate the system (disconnect network) to prevent lateral spread, disable System Restore to clear infected restore points, execute remediation tools to eliminate active malware, and finally re-enable System Restore and build a fresh restore point once the environment is clean.

Step-by-Step Solution

1
Isolate the infected machine from the environment.
Network communication is terminated, stopping potential lateral malware propagation.
Workstation isolation must occur immediately after identifying malware symptoms.
2
Disable System Restore.
Existing restore points containing malware are removed or locked from reinfecting the system.
Disabling restore functionality prevents malware from surviving remediation through system rollbacks.
3
Remediate the infected system using updated anti-malware utilities.
Malicious code and files are quarantined or deleted.
Remediation cleans active threats from local drives.
4
Re-enable System Restore and generate a clean restore point.
A clean recovery baseline is established for future system protection.
System Restore is re-enabled only after full remediation and system updates are complete.

Key Concept

CompTIA 7-Step Malware Removal Process
Question 342Question →

A desktop support technician is remediating an enterprise workstation experiencing severe browser hijacking, unexpected ad pop-ups, and forced website redirects. Place the following remediation steps in the correct order to resolve the browser compromise and verify system integrity.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of remediation is: First, isolate the workstation from the network. Second, terminate active browser processes via Task Manager. Third, remove rogue browser extensions and reset browser defaults. Fourth, check system proxy settings and the hosts file for unauthorized redirect rules. Fifth, run a full anti-malware scan and reconnect the network to verify system functionality.
The correct remediation sequence follows standard incident containment and malware removal procedures: first isolating the machine to stop malicious data transfer, stopping active processes to release file locks, clearing localized browser extensions and settings, auditing OS-level redirect mechanisms (hosts file and proxy settings), and finally scanning for secondary payloads while verifying clean connectivity.

Step-by-Step Solution

1
Isolate the compromised system from the network.
Network communication between the host and malicious external servers is halted.
CompTIA best practices dictate containing the incident prior to active remediation.
2
Close malicious or frozen browser tasks using Task Manager.
Browser memory is freed and open lock handles on profile files are released.
Terminating processes stops ongoing pop-ups and allows profile resetting without file access conflicts.
3
Remove rogue extensions and perform a browser reset.
Adware addons, hijacked homepages, and altered search engines are removed.
Unwanted extensions are the primary vector for persistent browser redirects and ad injections.
4
Inspect Windows hosts file (C:\Windows\System32\drivers\etc\hosts) and system proxy settings.
System-wide redirect configurations and loopback/proxy hijack entries are identified and purged.
Hijackers frequently alter proxy settings or append malicious static IP mappings into the hosts file to maintain redirects across browsers.
5
Perform anti-malware scanning and functional verification.
Secondary payload components are removed and browser behavior is confirmed clean under active network conditions.
Final scanning ensures no rootkit or trojan dropper remains, while live testing confirms full resolution.

Key Concept

Browser Security and Hijack Remediation Workflow
Question 343Question →

An IT technician at a regional freight logistics hub observes unauthorized file encryption and suspicious outbound network traffic on a dispatcher's Windows 11 workstation. The technician immediately disconnects the system from the network. Place the subsequent remediation steps in the correct order according to CompTIA's standard 7-step malware removal process.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order follows CompTIA's official 7-step malware removal process: 1. Disable System Restore in Windows, 2. Update anti-malware definition signatures, 3. Perform a full system anti-malware scan and remove detected threats, 4. Re-enable System Restore and create a clean restore point, 5. Educate the dispatcher on recognizing email phishing and security awareness.
CompTIA defines a strict 7-step malware remediation procedure: 1. Identify malware symptoms, 2. Quarantine infected systems, 3. Disable System Restore, 4. Remediate infected systems (a. Update anti-malware software/signatures, b. Scan and use removal techniques), 5. Schedule scans and run updates, 6. Enable System Restore and create a restore point, and 7. Educate the end user. Since the scenario states the malware has been identified and isolated (Steps 1 & 2), the correct subsequent sequence begins with disabling System Restore, updating signatures, scanning and removing threats, re-enabling System Restore to create a clean restore point, and concluding with end-user training.

Step-by-Step Solution

1
Analyze initial condition
The threat has been identified (Step 1) and isolated/quarantined from the network (Step 2).
The next required action in sequence is Step 3: Disable System Restore.
2
Disable System Restore (Step 3)
System Restore and shadow copies are turned off.
Prevents malware files from being saved into system restore snapshots during cleanup.
3
Remediate - Update signatures (Step 4a)
Definition files are updated to current versions.
Ensures the scanner has the most up-to-date detection logic.
4
Remediate - Scan and isolate/remove (Step 4b)
Infected system files are cleaned or deleted.
Removes active malware components from the system.
5
Re-enable System Restore and create restore point (Step 6)
System protection is re-engaged with a clean state snapshot.
Establishes a healthy baseline post-remediation.
6
Educate the end user (Step 7)
Dispatcher receives security training.
Completes the process by reinforcing preventive behavior.

Key Concept

CompTIA 7-Step Malware Removal Process
Question 344Question →

A technician is troubleshooting a legacy BIOS system that fails to start due to corrupted boot files and a missing boot configuration. Place the WinRE command-line recovery steps in the correct chronological order to repair the boot infrastructure using the bootrec tool.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order starts by booting into WinRE Command Prompt, followed by running bootrec /fixmbr, then bootrec /fixboot, then bootrec /scanos, and concluding with bootrec /rebuildbcd.
Troubleshooting begins by accessing WinRE Command Prompt. Next, repairing disk MBR code (bootrec /fixmbr) and partition boot sector code (bootrec /fixboot) restores critical low-level boot loaders. Scanning for OS installations (bootrec /scanos) detects existing Windows installations. Finally, rebuilding the Boot Configuration Data (bootrec /rebuildbcd) incorporates those installations into a fresh startup configuration.

Step-by-Step Solution

1
Boot into Windows Recovery Environment (WinRE) Command Prompt.
Access to offline boot repair tools is established.
Boot repair utilities must be executed in an offline environment when the main OS fails to launch.
2
Run bootrec /fixmbr to restore the MBR.
Master Boot Record code is updated on the primary partition table.
Restoring the MBR fixes disk-level boot loader corruption necessary for initial system handoff.
3
Run bootrec /fixboot to restore the partition boot sector.
A new partition boot sector compatible with Windows Boot Manager is written.
The partition boot sector hands off execution control from the MBR to bootmgr.
4
Run bootrec /scanos to locate installed operating systems.
All compatible Windows installations missing from the current BCD are detected.
Scanning locates OS installations required to rebuild the BCD configuration.
5
Run bootrec /rebuildbcd to regenerate the Boot Configuration Data file.
The BCD store is fully restored with valid OS startup parameters.
Rebuilding BCD allows Windows Boot Manager to present and load the operating system upon reboot.

Key Concept

Windows Bootrec Diagnostic and Repair Sequence
Question 345Question →

A technician is troubleshooting a desktop computer that displays no power LEDs and produces no fan rotation when the power button is pressed. Arrange the troubleshooting steps below in the correct order, from the initial basic physical checks to final component replacement.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: 1) Verify wall outlet power and the PSU rear rocker switch, 2) Inspect and reseat the 24-pin ATX and 8-pin CPU power connectors on the motherboard, 3) Disconnect internal power cables and test PSU output rail voltages using a PSU tester, and 4) Replace the motherboard after confirming normal PSU voltage output.
Following standard troubleshooting methodology, a technician must always start with the simplest, least invasive external checks (verifying AC outlet power and the rear PSU switch), then progress to internal cable seating, followed by diagnostic testing of the power supply using a tester, and finally replacing the motherboard once the PSU has been verified functional.

Step-by-Step Solution

1
Perform initial external power verification.
Ensures the system is receiving AC power from the wall and the PSU power switch is enabled.
CompTIA troubleshooting methodology requires starting with simple, non-invasive external checks first.
2
Inspect internal power connections.
Confirms that power from the PSU can flow to the motherboard and processor.
Loose motherboard power connectors can mimic a dead power supply or motherboard failure.
3
Test PSU voltage rails directly.
Determines whether the PSU is providing proper +12V, +5V, and +3.3V DC power.
Isolating the power supply pinpoints whether the power delivery unit is defective before replacing core motherboard components.
4
Replace the motherboard.
Restores system operation when a known-good PSU produces no power response from the motherboard.
Once the PSU is confirmed fully functional, a total lack of power response indicates a faulty motherboard.

Key Concept

CompTIA hardware troubleshooting methodology for complete power failure scenarios.
Estimated Time:1m 0s
Question 346Question →

A technician is troubleshooting a custom line-of-business application that has stopped responding on a Windows 11 workstation. The application window is frozen, and CPU utilization remains high. Place the troubleshooting and isolation steps in the correct chronological sequence that a technician should follow to diagnose, capture diagnostic evidence, recover system responsiveness, and identify the root cause module.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: 1) Analyze the wait chain in Resource Monitor to check for thread contention, 2) Create a memory dump file in Task Manager to preserve volatile memory, 3) End the task in Task Manager to terminate the frozen process, and 4) Inspect Event Viewer Application logs for Event ID 1000 or 1002 faulting module information.
The correct troubleshooting workflow prioritizes live non-destructive diagnosis and memory state preservation prior to process termination. First, Analyze Wait Chain in Resource Monitor inspects real-time thread dependencies. Second, creating a memory dump in Task Manager preserves volatile RAM data for debugging. Third, End Task clears the hung application from system resources. Fourth, Event Viewer Application logs (Event ID 1000/1002) are examined to identify the faulting DLL or binary.

Step-by-Step Solution

1
Use Resource Monitor to Analyze Wait Chain on the target process.
Determines whether the application is waiting on another locked thread or system process.
Troubleshooting active application hangs starts with non-destructive live diagnostics.
2
Create a process memory dump file through Task Manager.
Generates a snapshot file containing process memory details for developer debugging.
Dumping memory must occur before process termination, as ending the task destroys volatile RAM state.
3
Terminate the unresponsive application using End Task in Task Manager.
Frees up CPU and system memory resources locked by the hung application.
After capturing diagnostic data, clearing the hung process restores user productivity.
4
Examine Event Viewer logs under Windows Logs > Application.
Provides logged crash/hang details, including the faulting module path and exception codes.
System logs document the specific component fault for root-cause resolution.

Key Concept

Methodical sequence for isolating hung Windows applications while preserving diagnostic evidence.
Question 347Question →

A user reports that an enterprise database reporting tool on a Windows 11 workstation consistently crashes upon opening specific reporting modules. What is the correct sequence of troubleshooting steps a technician should follow to identify the faulting component and remediate system dependency corruption using Windows administrative tools?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with reviewing Event Viewer Application logs for Event ID 1000 crash details, running System File Checker (sfc /scannow) to repair system files, executing DISM /Online /Cleanup-Image /RestoreHealth if the component store is damaged, and finally re-running sfc /scannow to complete file restoration.
The proper troubleshooting process begins by examining Event Viewer Application logs for Event ID 1000 details to verify if a system module caused the crash. The technician then runs System File Checker (sfc /scannowsfc\ /scannow) to repair damaged files. If SFC encounters corrupted files it cannot fix due to store corruption, DISM (dism /online /cleanup−image /restorehealthdism\ /online\ /cleanup-image\ /restorehealth) must be executed to repair the Windows component store. Finally, executing sfc /scannowsfc\ /scannow a second time applies the repairs using the restored component store.

Step-by-Step Solution

1
Review diagnostic logs in Event Viewer
Locate Event ID 1000 entry containing the faulting application name, faulting module path, and crash offset.
Gathers empirical diagnostic evidence to determine if system file corruption is the underlying cause of the crash.
2
Run initial System File Checker scan
Detect corrupt protected system files, but encounter errors if the local component store is compromised.
SFC verifies system file integrity against the local Windows component store.
3
Execute DISM image restoration command
Fetch clean payload binaries from Windows Update or local media to repair the Component Store (WinSxS).
DISM repairs the component store payload when SFC cannot restore files due to local cache corruption.
4
Re-run System File Checker scan
Successfully repair and replace corrupted operating system files using the refreshed component store.
Completes system binary remediation using the newly validated store payload.

Key Concept

Troubleshooting Application Crashes and Windows System File Repair Sequence
Question 348Question →

A technician is servicing a computer that experiences a Stop Screen crash referencing a corrupted third-party storage driver during early OS initialization. The system fails to load Windows and constantly reboots. The technician must remove the faulty driver package offline using command-line tools without loading the full operating system. Place the steps in the correct order to resolve this boot error.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of operations is to first enter WinRE Command Prompt, then query installed third-party drivers using DISM to locate the driver's published INF name, next remove the specific driver package via DISM remove-driver, and finally restart the computer to verify standard startup.
When a newly updated or corrupted driver causes a recurring early-boot Stop Screen (BSOD), the technician must perform offline driver servicing. The process starts by booting into WinRE Command Prompt. The technician must first enumerate the offline driver store using DISM to locate the specific Published Name assigned to the driver (e.g., oem12.inf). Once identified, DISM is used to remove that specific driver package from the offline image. Finally, rebooting the system confirms that Windows can initialize successfully without triggering the crash.

Step-by-Step Solution

1
Access the Windows Recovery Environment (WinRE) Command Prompt.
Obtains an offline command-line environment targeting the unbootable C: drive.
Offline servicing is required because active driver files cannot be modified or uninstalled while Windows is running or continuously crashing.
2
Run dism /image:C:\ /get-drivers.
Generates a complete list of third-party drivers along with their assigned Published Names (e.g., oem12.inf).
DISM requires the specific published INF package name to targetedly remove a driver from an offline image.
3
Run dism /image:C:\ /remove-driver /driver:oem12.inf.
Uninstalls the specified driver package from the offline system image.
Removing the corrupted driver prevents Windows from attempting to initialize it during the early boot phase.
4
Reboot the workstation normally.
Windows completes initialization without crashing.
Verifies that eliminating the corrupted third-party driver successfully restores normal OS startup.

Key Concept

Offline Driver Servicing via DISM in WinRE
Estimated Time:2m 0s
Question 349Question →

A desktop technician is following standard CompTIA operational guidelines to resolve a confirmed malware infection on a user's workstation. Arrange the following malware remediation steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for standard malware removal follows CompTIA's 7-step process: 1. Isolate the infected workstation from the network, 2. Disable System Restore in Windows, 3. Remediate the infected system using anti-malware software, 4. Enable System Restore and create a new restore point, and 5. Educate the end user on security best practices.
The standard CompTIA 7-step malware removal workflow dictates a precise order: 1. Identify malware symptoms, 2. Isolate infected systems, 3. Disable System Restore, 4. Remediate infected systems (update anti-malware, scan/remove), 5. Schedule scans and run updates, 6. Enable System Restore and create a restore point, and 7. Educate the end user. Following this order ensures network containment, prevents reinfection via legacy restore points, thoroughly cleans system files, and establishes a clean recovery baseline before training the user.

Step-by-Step Solution

1
Isolate the infected workstation from the network
Disconnects Ethernet/Wi-Fi to prevent malware from spreading to other network resources.
Network containment must take place immediately after malware identification.
2
Disable System Restore in Windows
Deletes infected restore points and stops Windows from archiving malicious files.
System Restore must be turned off prior to scanning to ensure malware cannot persist in restore point archives.
3
Remediate the infected system using anti-malware software
Scans system files and removes active malicious code.
Anti-malware definitions are updated and scans are run to clean the environment.
4
Enable System Restore and create a new restore point
Re-establishes system protection with a known-good baseline.
System Restore is re-enabled only after full remediation and system verification.
5
Educate the end user on security best practices
Teaches the user how to identify phishing attempts and unsafe browsing behaviors.
User training is the final step in closing the remediation lifecycle.

Key Concept

CompTIA 7-Step Malware Removal Procedure
Question 350Question →

A Windows 11 workstation used by a financial analyst continuously experiences sudden application crashes and system unresponsiveness during intensive data processing tasks. The technician suspects a memory leak from a background service combined with virtual memory exhaustion due to improper pagefile settings. Arrange the following diagnostic and remediation actions in the correct chronological order to systematically isolate the faulting process, reconfigure virtual memory, and confirm resolution.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct troubleshooting sequence is: 1) Open Task Manager to inspect physical RAM usage versus Commit Charge, 2) Launch Resource Monitor and sort processes by Commit (KB) to isolate the leaking service, 3) Configure virtual memory to automatic management in sysdm.cpl, 4) Disable the leaking third-party service via System Configuration (msconfig), and 5) Restart the system and verify stability using Reliability Monitor (perfmon /rel).
Systematic troubleshooting of Windows performance and application crashes requires progressing from macro-level metric assessment (Task Manager commit charge) to micro-level process isolation (Resource Monitor commit sorting), system resource reconfiguration (virtual memory pagefile adjustment in sysdm.cpl), root cause remediation (disabling the offending service in MSConfig), and post-fix validation (Reliability Monitor).

Step-by-Step Solution

1
Examine overall system commit metrics in Task Manager.
Identified whether total memory allocation demands exceed physical RAM limits.
Task Manager provides immediate macro-level metrics showing if physical RAM is exhausted and if the system commit charge is approaching the commit limit.
2
Pinpoint the specific process consuming excessive memory in Resource Monitor.
Isolated the exact third-party executable responsible for the memory leak.
Resource Monitor breaks down private working set memory and commit charge per process, exposing background memory leaks.
3
Adjust virtual memory pagefile configuration in Advanced System Settings (sysdm.cpl).
Eliminated artificial pagefile size restrictions.
Enabling automatic pagefile management prevents Windows from abruptly crashing applications due to fixed paging file limits.
4
Prevent the faulty background service from launching on boot using msconfig.
Stopped the offending service from executing on system startup.
Disabling non-essential third-party services in System Configuration stops the memory leak at the root cause.
5
Verify long-term system stability in Reliability Monitor.
Confirmed application crash events have ceased and the stability index has recovered.
Reliability Monitor provides a historical timeline of application failures and system stability ratings to validate the fix.

Key Concept

Troubleshooting memory leaks and application crashes using Task Manager, Resource Monitor, Virtual Memory management (sysdm.cpl), MSConfig, and Reliability Monitor.
Question 351Question →

A network administrator suspects that a domain controller housed in a branch office has been infected with spyware after detecting unusual outgoing traffic patterns and unauthorized registry modifications. To ensure complete remediation following CompTIA's standard best practices, in what precise order should the administrator perform the following post-isolation actions?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of procedures is: Disable System Restore in Windows -> Update anti-malware signatures and perform a full system scan -> Schedule recurring anti-malware scans and verify automatic OS updates -> Enable System Restore and create a clean restore point -> Conduct security awareness training.
According to CompTIA's official 7-step malware removal process, after identifying the malware symptoms (Step 1) and isolating the system (Step 2), the technician must disable System Restore (Step 3) to prevent malicious files from persisting in restore points. Next comes remediation (Step 4), which includes updating signatures and executing scans. After remediation, the technician schedules regular scans and OS updates (Step 5), re-enables System Restore and creates a clean restore point (Step 6), and finally educates the end user (Step 7).

Step-by-Step Solution

1
Disable System Restore in Windows
Prevents infected files from being preserved in restore points.
If System Restore remains active, anti-malware utilities cannot purge malicious files held within protected system restore points.
2
Remediate infected systems (Update anti-malware software & scan/remove)
Purges active malware components from disk and memory.
Anti-malware definitions must be updated prior to running a full system scan to detect the latest threat signatures.
3
Schedule scans and run updates
Ensures proactive continuous protection and OS patching.
Automating anti-malware scans and system updates hardens the system against re-infection.
4
Enable System Restore and create a restore point
Establishes a clean recovery baseline.
System Restore must only be re-enabled after verifying the system is entirely clear of infection to avoid backing up malware.
5
Educate the end user
Mitigates operational security risks.
Providing security awareness training completes the 7-step remediation framework by addressing human risk factors.

Key Concept

CompTIA 7-Step Malware Removal Procedure Sequence
Question 352Question →

A desktop support technician is troubleshooting a workstation where the web browser continuously redirects to a suspicious search portal upon launch. The technician suspects that a rogue browser extension was installed alongside a recent software download. Place the following remediation steps in the correct sequence to resolve this browser security issue.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of steps is: 1) Isolate the computer from the local network and terminate all running web browser processes, 2) Access the browser extensions menu and remove all unrecognized or malicious add-ons, 3) Restore the browser home page, new tab settings, and default search engine to corporate defaults, 4) Clear the browser temporary files, cache, cookies, and site data, and 5) Execute a full anti-malware scan and verify hosts file integrity.
Proper remediation of browser hijacking requires isolating the system, eliminating the malicious extension, resetting altered browser configurations, purging cached redirect scripts, and conducting a full system scan to verify endpoint health.

Step-by-Step Solution

1
Isolate the system and end browser tasks
Network communication to malicious servers is halted and running scripts are closed.
Prevents further data exfiltration or additional payload downloads.
2
Remove unauthorized browser extensions
The core component enforcing the redirect is uninstalled.
Root cause of the browser hijacking must be eliminated before settings can be permanently restored.
3
Reset browser search engine and home page settings
Default startup pages and search defaults return to legitimate corporate URLs.
Ensures the browser no longer attempts to navigate to the hijacker's domain.
4
Clear cache, cookies, and browsing data
Stored malicious session cookies and redirection scripts are deleted.
Removes residual tracking data and prevents cached redirects from triggering.
5
Run full anti-malware scan and verify hosts file
System-level clean state is confirmed.
Verifies that no secondary malware infections or modified hosts file entries remain on the endpoint.

Key Concept

Browser Hijacker Remediation Sequence
Question 353Question →

A desktop technician at an autonomous agricultural equipment monitoring facility is remediating a Windows 11 workstation infected with rogue adware and tracking spyware. The technician has already identified the malware symptoms on the system. Place the following remediation steps in the correct order to resolve the incident according to CompTIA best practices.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of remediation steps is: 1) Disconnect the infected workstation from the network, 2) Disable Windows System Restore, 3) Update anti-malware signatures and execute a full scan, 4) Re-enable Windows System Restore and create a new restore point, 5) Conduct security awareness training with the operator.
The standard CompTIA 7-step malware removal process must be performed in exact sequence: (1) Identify malware symptoms, (2) Quarantine infected systems, (3) Disable System Restore, (4) Remediate infected systems (update definitions then scan/use removal tools), (5) Schedule updates and scans, (6) Enable System Restore and create a restore point, and (7) Educate the end user. Following this sequence isolates the threat early, prevents malware persistence in recovery points, cleans the system thoroughly, re-establishes protection baselines, and mitigates future occurrences.

Step-by-Step Solution

1
Isolate the infected host from the network environment.
Network communication is halted, preventing potential lateral movement or data exfiltration.
CompTIA Step 2 requires quarantining the system immediately after symptom identification.
2
Turn off Windows System Restore.
Existing restore points containing malicious files are cleared and no new corrupted snapshots are saved.
CompTIA Step 3 ensures that infected state data is not archived into backup restore points.
3
Update malware definitions and execute a comprehensive system scan.
The malware is detected using the latest signatures and safely purged from disk and memory.
CompTIA Step 4 dictates updating definition files first, followed by scanning and remediation.
4
Enable System Restore and generate a fresh restore point.
A clean recovery baseline is created for the fully remediated operating system.
CompTIA Step 6 restores rollback capability only after verifying the system is entirely clean.
5
Provide threat awareness training to the primary user.
The user learns best practices to prevent similar malicious software infections in the future.
CompTIA Step 7 completes the process by educating the user to minimize future risk.

Key Concept

CompTIA 7-Step Malware Remediation Best Practices
Question 354Question →

An IT technician is tasked with performing baseline workstation hardening on a newly deployed Windows system before issuing it to an employee. In which sequential order should the technician perform these hardening steps to establish proper security controls from account access to session security?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct procedural order is: first, disable the built-in Guest account and rename the default Administrator account; second, configure local password complexity and account lockout policies; third, disable AutoRun and AutoPlay for external media; and fourth, enable a screen lock timeout requiring a password on resume.
The correct order follows standard baseline security principles: eliminating high-risk default account exposure first, establishing robust user authentication rules second, restricting dangerous system automation (AutoRun/AutoPlay) third, and finalizing local physical session security (screen lock timeouts) fourth.

Step-by-Step Solution

1
Address account vulnerabilities by disabling the Guest account and renaming the default Administrator account.
Known default account vectors are closed, preventing unauthorized privilege escalation.
Securing default credentials must occur before enabling broader account governance policies.
2
Define password complexity and lockout policies in Local Security Policy.
User authentication rules are hardened against dictionary and brute-force attempts.
Password and lockout baselines enforce credential strength for all created user profiles.
3
Configure Local Group Policy to disable AutoRun and AutoPlay.
Automatic background execution from connected USB or optical media is suppressed.
Restricting peripheral execution protects the system from drive-by hardware infection.
4
Set the screen saver timeout and enforce password protection upon waking.
Active user sessions lock automatically during periods of inactivity.
Session protection prevents unauthorized physical access when an authorized user steps away.

Key Concept

Workstation Baseline Hardening Sequence
Question 355Question →

A technician is investigating a Windows 11 workstation where an enterprise application gradually consumes available system memory, causing severe system slowdowns after several hours of operation. In what order should the technician perform the following troubleshooting steps to identify and isolate the root cause?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct troubleshooting sequence begins with monitoring active process memory metrics in Task Manager and Resource Monitor, followed by reviewing Event Viewer application logs for crash and resource exhaustion events (Event ID 1000 and 2004). Next, configure a clean boot state using System Configuration (msconfig) by hiding Microsoft services and disabling non-Microsoft services. Finally, reboot the system and incrementally re-enable services to isolate the specific application service causing the memory leak.
The standard CompTIA troubleshooting workflow for application memory leaks and crashes requires first gathering live diagnostic metrics (Task Manager/Resource Monitor), reviewing recorded log events (Event Viewer Event IDs 1000/2004), establishing a clean startup baseline (msconfig with Microsoft services hidden), and systematically testing services after a reboot to isolate the offending third-party service.

Step-by-Step Solution

1
Observe live system resource metrics using Task Manager and Resource Monitor.
Identifies high memory utilization, uncommitted Working Set growth, or memory leak patterns in real time.
Troubleshooting begins with active observation and symptom verification without altering system state.
2
Inspect Windows Event Viewer Application logs for related fault events.
Gathers specific error codes, event IDs (such as Event 1000 Application Error or Event 2004 Resource Exhaustion), and faulting module names.
Correlating live symptoms with system log data confirms the underlying executable and failure mechanism.
3
Open System Configuration (msconfig) to configure a clean boot environment.
Disables third-party services and startup items while preserving critical Microsoft OS services.
Establishes a baseline software environment free from non-essential background service interference.
4
Reboot the computer and systematically re-enable startup services.
Isolates the individual third-party service causing memory degradation upon re-activation.
Incremental isolation testing in a clean boot environment pinpoints the precise service or application responsible.

Key Concept

Methodological isolation of Windows application crashes and memory leaks
Question 356Question →

A cybersecurity technician is responding to a compromised Windows 11 enterprise workstation exhibiting unauthorized network beaconing and modified system files. Arrange the following technician actions in the correct chronological sequence mandated by the official CompTIA 7-step malware removal procedure, starting with the earliest action.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order follows CompTIA's standard 7-step malware removal protocol: 1) Quarantine the endpoint by disconnecting network interfaces (Isolate), 2) Turn off System Protection (Disable System Restore), 3) Update signature files and perform a full scan (Remediate), 4) Enable automatic OS updates and schedule regular scans (Schedule scans and updates), and 5) Turn System Protection back on and generate a clean restore point (Enable System Restore).
The correct sequence directly adheres to CompTIA's official 7-step malware removal process: Step 2 requires isolating the infected device (disconnecting Ethernet and Wi-Fi) to contain the threat. Step 3 requires disabling System Restore to clear infected restore points. Step 4 encompasses remediating the system by updating anti-malware signatures and executing scans. Step 5 involves scheduling automated scans and applying OS updates. Step 6 involves re-enabling System Restore and generating a new, known-good restore point.

Step-by-Step Solution

1
Isolate the compromised system.
Prevents active malware from spreading laterally across the enterprise network or communicating with command-and-control servers.
System isolation is Step 2 and must occur immediately after malware symptoms are recognized.
2
Disable System Restore / System Protection.
Deletes stored restore points that could retain copy-protected malicious binaries.
Step 3 prevents accidental system reinfection during or after the remediation phase.
3
Remediate the infected environment.
Anti-malware definitions are updated offline or via safe methods, and malicious software is successfully purged.
Step 4 focuses on active eradication using updated software and dedicated removal tools.
4
Schedule scans and install OS/application updates.
Patches system vulnerabilities and establishes ongoing automated monitoring to prevent reinfection.
Step 5 ensures long-term system integrity once active threats have been eradicated.
5
Enable System Restore and create a clean restore point.
Establishes a verified, uninfected recovery baseline for future troubleshooting.
Step 6 must only occur after confirming the system is patched, clean, and fully operational.

Key Concept

CompTIA 7-Step Malware Removal Procedure
Question 357Question →

A desktop technician is performing malware remediation on a compromised Windows 10 workstation controlling automated machinery on a manufacturing floor. The technician has already confirmed malware infection symptoms and physically disconnected the ethernet cable to isolate the system. In what exact order should the technician perform the remaining steps to complete the standard CompTIA malware removal process?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for the remaining remediation steps is: Disable System Restore, Update anti-malware signatures offline and execute a full scan, Configure recurring automated scans and schedule OS security updates, Enable System Restore and generate a clean system restore point, and Conduct end-user security training.
According to CompTIA's official 7-step malware removal process, after identifying the symptoms (Step 1) and isolating the system (Step 2), the technician must proceed through the remaining steps in strict sequence: Step 3 is Disabling System Restore, Step 4 is Remediating infected systems (updating anti-malware signatures and scanning), Step 5 is Scheduling scans and running updates, Step 6 is Enabling System Restore and creating a new restore point, and Step 7 is Educating the end user.

Step-by-Step Solution

1
Identify malware symptoms
Malware presence confirmed (already completed in scenario).
Establishes the problem state before taking remediation steps.
2
Isolate infected systems
Ethernet cable disconnected (already completed in scenario).
Prevents lateral movement across the manufacturing network.
3
Disable System Restore
System Protection disabled; corrupted restore points purged.
Prevents the infected system from keeping backup copies of infected binaries during cleaning.
4
Remediate infected systems
Anti-malware definitions updated via external media and full system scan completed.
Ensures active malicious processes and files are completely quarantined and erased.
5
Schedule scans and run updates
Scheduled tasks created for periodic scanning and Windows Update checks.
Ensures long-term protection against re-infection.
6
Enable System Restore and create restore point
System Protection enabled; baseline restore point created.
Provides a healthy recovery baseline now that the OS is known clean.
7
Educate end user
Operators trained on security awareness and threat prevention.
Reduces human-factor vulnerability to future attacks.

Key Concept

CompTIA 7-Step Best Practice Methodology for Malware Removal
Question 358Question →

An IT support technician is remediating a malware-infected Windows workstation following the official CompTIA 7-step malware removal process. Place the following steps of the remediation procedure in the correct sequential order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: 1) Isolate the infected workstation from the network, 2) Disable System Restore in Windows, 3) Update anti-malware signatures and perform full system remediation scans, and 4) Re-enable System Restore and create a clean restore point.
The standard CompTIA 7-step malware removal process strictly follows this sequence: 1. Identify malware symptoms, 2. Isolate the infected system, 3. Disable System Restore, 4. Remediate infected systems, 5. Schedule scans and run updates, 6. Enable System Restore and create a restore point, and 7. Educate the end user. Disconnecting network access comes first among these choices to contain the threat, followed by disabling restore points, executing anti-malware scans/remediation, and finally re-enabling System Restore once cleanliness is assured.

Step-by-Step Solution

1
Isolate the system
The infected endpoint is disconnected from wireless and wired network connections.
Prevents the malware from spreading to other systems on the network or communicating with remote command-and-control servers.
2
Disable System Restore
System Restore is turned off and existing restore points containing infected files are cleared.
Ensures that malware cannot be restored inadvertently from an infected restore point later.
3
Remediate infected systems
Anti-malware software is updated with current definition files and full system scans are run.
Identifies and removes active malware threats and associated infected files.
4
Re-enable System Restore
System Restore is re-enabled and a new, verified clean system restore point is created.
Establishes a reliable recovery point now that the machine is entirely clean.

Key Concept

CompTIA 7-Step Malware Remediation Procedure
Question 359Question →

A Windows 11 workstation equipped with UEFI firmware fails to start, displaying an error stating that the Boot Configuration Data (BCD) file is missing or corrupted. Automatic Repair is unable to resolve the issue. A system administrator boots the computer using Windows installation media to manually rebuild the EFI System Partition (ESP) boot loader from the Command Prompt. Place the technician's administrative steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with booting into the WinRE Command Prompt via installation media, using diskpart to identify and assign a drive letter to the hidden EFI System Partition, formatting that partition as FAT32, executing the bcdboot command to reconstruct the EFI boot store, and finally rebooting the workstation to confirm normal startup.
The correct order follows the standard procedure for repairing corrupted UEFI boot structures: first boot into an offline command shell, mounting/lettering the hidden EFI partition, wiping existing corrupt boot headers with a FAT32 format, writing new boot files with bcdboot, and rebooting to complete testing.

Step-by-Step Solution

1
Boot from Windows 11 installation media and select 'Repair your computer' to open the WinRE Command Prompt.
Obtained offline administrative CLI access to the unbootable workstation.
System partition modification and offline BCD repairs require an unmounted, offline recovery environment.
2
Launch Diskpart, select the disk and EFI System Partition, and run 'assign letter=S'.
The hidden FAT32 EFI System Partition becomes accessible via drive letter S:.
UEFI bootloader recovery commands require a target drive letter path to apply new boot files.
3
Execute 'format S: /FS:FAT32' within Diskpart or Command Prompt.
The target partition is clean-formatted with the mandatory FAT32 file system.
Clearing corrupted file systems and damaged boot blocks ensures clean deployment of replacement boot infrastructure.
4
Run 'bcdboot C:\Windows /s S: /f UEFI'.
Fresh UEFI boot files and BCD entries are copied from C:\Windows into S:.
The bcdboot tool initializes the EFI System Partition with essential boot files and BCD configuration mandatory for UEFI startup.
5
Remove installation media, exit the command prompt, and restart the system.
The workstation successfully boots into the Windows operating system.
Rebooting verifies that the UEFI firmware correctly detects the restored EFI System Partition boot sequence.

Key Concept

Manual repair of corrupt UEFI/GPT boot structures using Diskpart and BCDBoot in WinRE.
Estimated Time:2m 0s
Question 360Question →

A technician is responding to a malware incident on a workstation at a community medical clinic. The system is showing pop-up warnings and redirecting browser traffic. Place the following remediation actions in the correct sequential order according to the standard CompTIA 7-step malware removal process.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order follows the standard CompTIA 7-step malware removal methodology: 1) Quarantine the infected system, 2) Disable System Restore, 3) Update anti-malware signatures and scan, 4) Re-enable System Restore and create a restore point, and 5) Educate the end user.
The CompTIA standard 7-step malware removal process follows a specific logical sequence: 1) Identify symptoms, 2) Quarantine system, 3) Disable System Restore, 4) Remediate infected systems (update definitions and scan), 5) Schedule updates and scans, 6) Enable System Restore and create restore point, and 7) Educate end user. The items provided map directly to steps 2, 3, 4, 6, and 7 in exact chronological order.

Step-by-Step Solution

1
Isolate the compromised system from the local environment.
Network communication is terminated, preventing malware spread.
Quarantine (Step 2) must occur before modifying system settings or performing scans.
2
Disable System Restore.
Existing restore points containing malicious files are cleared and new automatic restore points are suspended.
Disabling System Restore (Step 3) ensures malware cannot persist in Windows system restore points.
3
Remediate the infected system.
Anti-malware signatures are updated and malicious payloads are detected and removed.
Updating definitions and scanning (Step 4) removes the active infection from the machine.
4
Re-enable System Restore and create a clean restore point.
System protection is restored using a clean state baseline.
Re-enabling System Restore (Step 6) guarantees future recovery options without reintroducing cleared malware.
5
Conduct end-user training.
The user is informed about security best practices.
End-user education (Step 7) completes the workflow to help prevent future infections.

Key Concept

CompTIA 7-Step Malware Removal Process
PreviousPage 18 / 22Next
All practice questions — CompTIA A+ (Core 1 & Core 2) | Examkin