Examkin

Security

442 questions

All types442Multiple choice224Multiple select94Matching71Ordering53
Question 421Question →

A desktop support technician at a regional meteorology research institute discovers that a Windows workstation used for weather radar monitoring has been infected with a rootkit trojan. The technician needs to execute the standard CompTIA seven-step malware remediation process. Place the following remediation steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence follows the CompTIA 7-step malware remediation process: 1. Isolate the infected workstation (Quarantine), 2. Disable Windows System Restore, 3. Update anti-malware signatures and perform a full scan (Remediate), 4. Re-enable System Restore and create a clean restore point, 5. Train the user on security best practices (Educate user).
The correct order strictly follows the standard CompTIA malware removal procedure: Step 2 (Quarantine/Isolate), Step 3 (Disable System Restore), Step 4 (Remediate by updating definitions and scanning), Step 6 (Enable System Restore and create a restore point), and Step 7 (Educate the end user).

Step-by-Step Solution

1
Identify and Quarantine the System
Workstation is isolated from the network to stop lateral movement.
Quarantining the system immediately follows identification.
2
Disable System Restore
Infected restore points are deleted so malware cannot reinfect the system via system recovery.
System Restore must be disabled before running cleanup tools.
3
Remediate the System
Anti-malware signatures are updated and scans remove the rootkit.
Remediation involves updating definitions and executing scan and removal techniques.
4
Enable System Restore and Create a Restore Point
A fresh, uninfected baseline restore point is established.
System Restore is re-enabled only after confirming the system is clean.
5
Educate the End User
User learns how the infection occurred and how to prevent recurrence.
User education is always the final step in standard malware remediation.

Key Concept

CompTIA 7-Step Malware Remediation Best Practices
Question 422Question →

A systems administrator is configuring local security policies on standalone Windows workstations designated for short-term contractors at a financial services firm. To minimize the attack surface associated with default credential exploitation and unauthenticated local access, which of the following workstation hardening actions should the technician perform?

Show answer & explanation

Answer: Disable the built-in Guest account and rename the default Administrator account.

Answer

Disabling the built-in Guest account and renaming the default Administrator account is the best practice for local account hardening.
Disabling the built-in Guest account and renaming the default Administrator account reduces the workstation's attack surface by eliminating default entry points that attackers frequently target in automated brute-force attacks.

Step-by-Step Solution

1
Identify baseline account hardening security requirements for standalone Windows systems.
Recognize that default accounts (Administrator and Guest) present well-known targets for malicious actors.
Default accounts have well-known names and predictable configurations across default OS installations.
2
Apply local account hardening best practices.
Rename the built-in Administrator account and ensure the Guest account is completely disabled.
This mitigates automated password spraying and unauthorized local logon attempts.

Key Concept

Workstation Account Hardening and Default Account Management
Question 423Question →

An IT technician at a television broadcast studio is responding to a Windows workstation used for live news graphics that is displaying unauthorized pop-up advertisements and experiencing severe system slowdowns. The technician confirmed the presence of malware and unplugged the Ethernet cable to isolate the machine. According to the standard CompTIA 7-step malware remediation process, which action should the technician take NEXT?

Show answer & explanation

Answer: Disable System Restore in Windows.

Answer

Disable System Restore in Windows.
According to the official CompTIA 7-step malware remediation process, once the system is quarantined (Step 2), the technician must disable System Restore (Step 3) before attempting remediation. This prevents Windows from creating shadow copies or restore points containing the active infection.

Step-by-Step Solution

1
Identify current progress in the CompTIA 7-step malware remediation process.
Step 1 (Identify malware symptoms) and Step 2 (Quarantine the infected system) are already complete.
The technician confirmed symptoms and disconnected the device from the network.
2
Determine the next sequential step in the process.
Step 3 is to disable System Restore.
Disabling System Restore ensures that clean points are not overwritten with malware-infected backups during removal efforts.

Key Concept

CompTIA 7-Step Malware Remediation Process
Question 424Question →

An IT technician is tasked with applying baseline security controls to a newly provisioned standalone Windows computer before placing it into service. Place the following workstation hardening steps in the correct chronological order in which they should be executed from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order begins with securing account credentials (disabling Guest and changing default administrative passwords), followed by applying system updates and patches, disabling unneeded services and features to minimize the attack surface, and concluding with configuring local security policy controls.
The proper sequence for workstation hardening dictates securing account access first to prevent administrative exploitation, followed by updating and patching system software, disabling non-essential services and features to minimize attack vectors, and finally establishing local security policy thresholds.

Step-by-Step Solution

1
Secure local account access
Default administrative credentials are changed and the Guest account is disabled.
Securing local administrative accounts prevents unauthorized privileged access while performing further system management.
2
Apply system updates and patches
The OS is fully updated with current security patches and malware definitions.
Known security vulnerabilities are remediated before applying system policies.
3
Minimize attack surface
Unused services, open network ports, and AutoRun capabilities are turned off.
Closing unused entry points restricts potential vectors for unauthorized network access or unauthorized media execution.
4
Enforce local security policies
Account lockout thresholds and screensaver password requirements are enabled.
Configuring local security policies establishes operational session security for everyday usage.

Key Concept

Workstation Hardening Procedural Sequence
Question 425Question →

An IT technician at a smart grid distribution control center is troubleshooting a Windows 11 workstation connected to the operational network. The technician has confirmed the presence of trojan malware and has already isolated the workstation from the network. According to the CompTIA standard 7-step malware remediation process, which TWO of the following steps should the technician perform NEXT before initiating the system scan? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Disable System Restore in Windows.; Update anti-malware software and signature definitions.

Answer

The technician should disable System Restore in Windows and update the anti-malware software and signature definitions.
Following system isolation (Step 2), the standard CompTIA process requires disabling System Restore (Step 3) to prevent saving corrupted system files, followed by updating anti-malware signatures (Step 4a) to ensure full detection capabilities during the subsequent remediation scan.

Step-by-Step Solution

1
Determine current progress in the 7-step malware remediation process
Step 1 (Identify malware symptoms) and Step 2 (Quarantine the infected system) are already complete.
The scenario specifies that malware was identified and the workstation isolated.
2
Select the immediate next procedures required before scanning
Perform Step 3 (Disable System Restore) and Step 4a (Update anti-malware software/signatures).
System Restore must be disabled so infected files are not backed up, and scanner definitions must be updated to detect the latest malware signatures.

Key Concept

CompTIA 7-Step Malware Remediation Process
Question 426Question →

An IT technician is configuring public-facing check-in terminals in a healthcare facility lobby. The terminals run Windows 11 and use a restricted local user account. The technician needs to prevent unauthorized software from automatically executing whenever a visitor connects an external flash drive to one of the terminals. Which of the following configurations best achieves this hardening goal?

Show answer & explanation

Answer: Disable AutoPlay and AutoRun features using Local Group Policy.

Answer

Disable AutoPlay and AutoRun features using Local Group Policy.
Disabling AutoPlay and AutoRun via Group Policy prevents Windows from executing launch scripts or applications stored on removable drives when inserted. This effectively mitigates unauthorized drive-by code execution on public terminals.

Step-by-Step Solution

1
Identify the primary threat vector described in the scenario.
The threat is the automatic execution of untrusted code or scripts from newly attached USB flash drives.
When removable media is connected, default Windows settings may attempt to execute setup scripts or trigger AutoPlay actions.
2
Evaluate operating system hardening controls specific to removable media.
Disabling AutoPlay and AutoRun via policy restricts the operating system from reading autorun.inf files or launching default media actions automatically.
Hardening workstation policies against AutoPlay/AutoRun prevents untrusted programs on USB devices from compromising the system upon connection.

Key Concept

Workstation Hardening via Disabling AutoPlay and AutoRun Policies
Question 427Question →

An IT support technician at a hotel reception network center is troubleshooting a Windows workstation affected by keylogger malware. The technician has confirmed the infection, isolated the machine from the network, and disabled System Restore. Which of the following actions should the technician perform NEXT according to the CompTIA standard 7-step malware remediation process?

Show answer & explanation

Answer: Update the anti-malware signature definitions and perform a full system remediation scan.

Answer

Update the anti-malware signature definitions and perform a full system remediation scan.
The standard CompTIA 7-step malware remediation process follows a strict order: 1. Identify symptoms, 2. Quarantine infected system, 3. Disable System Restore, 4. Remediate infected systems (update anti-malware signatures and scan/remove), 5. Schedule updates and scans, 6. Enable System Restore and create a restore point, 7. Educate end-user. Because steps 1 through 3 are complete, the technician must execute Step 4 next by updating the anti-malware engine definitions and running a thorough remediation scan.

Step-by-Step Solution

1
Identify completed steps in the CompTIA 7-step malware remediation framework.
Step 1 (Identify symptoms), Step 2 (Quarantine system), and Step 3 (Disable System Restore) have already been completed.
Determining the current phase ensures proper progression without omitting required isolation or repair actions.
2
Determine the mandatory next phase in sequence.
Step 4 is 'Remediate infected systems'.
Remediation consists of updating anti-malware signatures/tools and conducting comprehensive scans to detect and remove active malware.
3
Select the option that corresponds to updating definition files and scanning.
Updating anti-malware signatures and running a full system scan is the direct next action.
Scanning with outdated signatures may fail to remove newly mutated malware strains.

Key Concept

CompTIA 7-Step Malware Remediation Process Sequence
Estimated Time:1m 15s
Question 428Question →

A security technician is developing an image baseline for mobile laptops used by traveling consultants. To protect systems against local privilege escalation and automated malware execution from untrusted removable drives, which TWO workstation hardening measures should the technician enforce?

Select all that apply

Show answer & explanation

Answer: Disable AutoPlay and AutoRun functionality for removable storage media.; Disable or rename the built-in local Administrator account.

Answer

Disabling AutoPlay and AutoRun functionality for removable storage media, and disabling or renaming the built-in local Administrator account.
Hardening a workstation image requires closing high-risk entry points and securing default accounts. Disabling AutoPlay and AutoRun prevents malicious scripts on connected USB drives from automatically executing. Disabling or renaming the built-in local Administrator account prevents malicious actors from leveraging standardized, well-known usernames for brute-force attacks or privilege escalation.

Step-by-Step Solution

1
Identify potential attack vectors related to external storage devices.
Disabling AutoPlay/AutoRun prevents untrusted executables from launching automatically when a USB device is inserted.
Automated code execution from external drives is a primary malware vector for mobile devices.
2
Identify local account hardening best practices.
Disabling or renaming default system accounts (such as the built-in Administrator) removes well-known targets for brute-force attack attempts.
Attackers target known default usernames to escalate privileges locally.

Key Concept

Workstation Hardening Controls
Question 429Question →

A cybersecurity technician at a automated logistics fulfillment hub is responding to a suspected malware infection on a inventory management workstation. Place the following remediation steps in the exact order required by the standard CompTIA malware removal procedure.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for malware remediation is: 1. Disconnect the affected workstation (Quarantine system), 2. Disable System Restore, 3. Update anti-malware signatures and scan (Remediate system), 4. Turn System Restore back on and generate a new restore point, 5. Conduct security awareness training with the workstation user.
The correct sequence follows the standard 7-step CompTIA malware remediation process: Quarantine the infected system, Disable System Restore, Remediate the system (update signatures and perform scans), Enable System Restore and create a restore point, and finally Educate the end user.

Step-by-Step Solution

1
Isolate the compromised machine from the network.
The machine is quarantined, containing the malware outbreak.
Prevents lateral network spread.
2
Disable Windows System Restore.
Previous restore points containing infection files are deleted.
Ensures malware cannot survive or be restored from infected backup states.
3
Update antivirus definitions and scan the system.
Malicious software components are identified and quarantined/deleted.
Cleans active threats from memory and drive storage.
4
Re-enable System Restore and create a clean snapshot.
System protection is restored with a pristine baseline.
Establishes a clean point of recovery for future OS protection.
5
Provide end-user training.
The user understands risk factors and safe computing habits.
Reduces recurrence of malware infections caused by human error.

Key Concept

CompTIA 7-Step Malware Remediation Best Practices
Question 430Question →

Match each workstation security hardening control on the left with its corresponding primary risk mitigation objective on the right.

Click a left item, then click its matching right item

Items

Account Lockout Threshold
Disabling the Built-in Guest Account
Closing Unused Listening Ports
Screen Saver Lock Timeout

Matches

Show answer & explanation

Answer

Account Lockout Threshold matches with mitigating brute-force credential attacks; Disabling the Built-in Guest Account matches with eliminating unauthenticated anonymous local system logon; Closing Unused Listening Ports matches with reducing the network attack surface by blocking unapproved remote connections; Screen Saver Lock Timeout matches with preventing unauthorized physical console access when workstations are unattended.
Each hardening control directly addresses a distinct attack vector: account lockout thresholds mitigate credential brute-forcing, disabling default guest accounts prevents unauthenticated anonymous access, closing unused ports shrinks the network attack surface, and enforcing a screen lock timeout prevents local physical tampering when the system is unattended.

Step-by-Step Solution

1
Analyze the role of the Account Lockout Threshold policy.
Identifies that locking an account after multiple invalid attempts prevents credential brute-forcing.
Restricts automated password guessing attempts.
2
Evaluate the risk of leaving default accounts enabled.
Determines that disabling the Guest account removes an inherent anonymous logon vector.
Enforces proper identification and user authentication baseline.
3
Assess the defensive benefit of closing unused network listening ports.
Recognizes that shutting down unneeded network services reduces entry points for remote exploits.
Shrinks the local device attack surface.
4
Examine the protection provided by setting a Screen Saver Lock Timeout.
Confirms that requiring re-authentication after inactivity secures unattended hardware.
Mitigates physical security exposure in open office or shared environments.

Key Concept

Workstation Security Hardening Control Objectives
Question 431Question →

A desktop technician at a biotechnology research facility is responding to a Windows workstation infected with trojan malware. The technician has confirmed the infection, isolated the computer from the local network, and disabled System Restore. Which of the following actions should the technician perform NEXT in accordance with the standard CompTIA malware remediation process?

Show answer & explanation

Answer: Update the anti-malware software definitions using an out-of-band method

Answer

Update the anti-malware software definitions using an out-of-band method
The standard CompTIA 7-step malware remediation process follows a strict order: 1. Identify symptoms, 2. Quarantine infected system, 3. Disable System Restore, 4. Remediate infected systems (a. Update anti-malware software, b. Scan and use removal techniques), 5. Schedule updates and scans, 6. Enable System Restore and create a restore point, 7. Educate the end user. Since the technician has already completed steps 1 through 3, the immediate next action is sub-step 4a: updating the anti-malware definitions.

Step-by-Step Solution

1
Identify the current step in the CompTIA 7-step malware remediation workflow
The technician has completed Step 1 (Identify), Step 2 (Quarantine), and Step 3 (Disable System Restore).
Tracking current progress determines the mandatory sequential next action.
2
Determine the sub-steps required for Step 4 (Remediate infected systems)
Remediation requires sub-step 4a (Update anti-malware definitions/engine) before sub-step 4b (Scan and use removal techniques).
Scanning with outdated signatures might fail to detect or clean active threat variants.
3
Select the correct action matching sub-step 4a
Updating anti-malware signatures via an out-of-band mechanism (such as a USB drive or dedicated update server while isolated) is the direct next step.
This maintains network quarantine while ensuring the scanner has up-to-date threat signatures.

Key Concept

CompTIA 7-Step Malware Remediation Process
Question 432Question →

An IT technician is hardening standalone Windows desktops used in a shared laboratory environment. To minimize the system's vulnerability to unauthorized network-based administrative access and remote configuration changes, the technician needs to disable non-essential background services. Which of the following services should be disabled to prevent remote users from modifying the system registry over the network?

Show answer & explanation

Answer: Remote Registry

Answer

Disabling the Remote Registry service is the best workstation hardening practice to stop unauthorized remote registry modifications over the network.
Disabling the Remote Registry service prevents users across the network from querying or altering the local Windows registry, directly reducing the workstation's remote attack surface without impacting normal local user operations.

Step-by-Step Solution

1
Identify the primary security objective described in the scenario.
The objective is to harden the workstation by disabling unnecessary network services that allow remote administrative tampering.
Workstation hardening follows the principle of least functionality by disabling services that expose network vulnerabilities.
2
Evaluate the function of each listed Windows service.
The Remote Registry service allows remote users to edit registry settings over the network. Disabling it prevents remote manipulation while retaining normal local OS operations.
Turning off unneeded network services reduces the remote attack surface.

Key Concept

Disabling Unnecessary Services and Hardening System Baselines
Question 433Question →

During a security assessment at a financial firm, auditors observe that employees frequently leave their Windows workstations unattended when stepping away from their desks, allowing unauthorized personnel to view sensitive customer data on active sessions. Which of the following workstation hardening measures should the IT technician implement to automatically secure idle sessions?

Show answer & explanation

Answer: Enforce a screen saver timeout policy that requires a password to resume the session.

Answer

Enforce a screen saver timeout policy that requires a password to resume the session.
Enforcing a screen saver timeout policy requiring a password on resume is an effective security control against walk-away risks. When an employee leaves a desktop unattended, the operating system detects inactivity, starts the screen saver, and locks the console. Any attempt to resume interaction requires entering the user's password, effectively preventing passersby from accessing sensitive data.

Step-by-Step Solution

1
Identify the primary threat presented in the scenario.
The core vulnerability is unauthorized physical access to active, logged-in user sessions due to unattended workstations.
Employees are walking away without manually locking their operating system sessions.
2
Evaluate potential workstation hardening controls to address session hijacking.
Automated session locking via screen saver timeout policies or screen locks enforces protection without relying solely on manual user compliance.
Configuring a screen saver lock forces the system to lock after a specified threshold of inactivity and demands valid user credentials to unlock.
3
Select the option that directly automates screen locking upon inactivity.
Enforcing a screen saver timeout policy with password protection on resume directly resolves the issue.
This is the standard CompTIA-recommended hardening procedure for preventing walk-away session vulnerability.

Key Concept

Workstation Hardening: Screen Lock and Inactivity Timeout Policies
Question 434Question →

A systems technician at an architectural design firm is working on a Windows workstation infected with a rogue malware threat. The technician has already identified the malware symptoms, isolated the machine from the local network, and disabled System Restore. Which TWO of the following actions should the technician perform NEXT during the remediation phase of the CompTIA 7-step malware remediation process? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Update the anti-malware engine and signature files.; Perform a complete malware scan using bootable media or Safe Mode.

Answer

The technician must update the anti-malware engine and signature files, and perform a complete malware scan using bootable media or Safe Mode.
Step 4 of the CompTIA 7-step malware remediation process specifies remediating the infected system by first updating the anti-malware signatures/engine and then performing scan and removal techniques in an isolated environment (such as Safe Mode or WinPE). Both of these actions directly satisfy Step 4.

Step-by-Step Solution

1
Identify the current step in the CompTIA 7-step malware remediation workflow.
Steps 1 (Identify symptoms), 2 (Quarantine system), and 3 (Disable System Restore) have already been completed.
The next logical phase is Step 4: Remediate infected systems.
2
Determine the required tasks within Step 4 (Remediate infected systems).
Step 4 consists of two sequential actions: (a) Update anti-malware software/signatures, and (b) Scan and use removal techniques (such as Safe Mode or bootable media).
Signatures must be updated prior to running scans so the system can accurately detect and eradicate the identified malware strain.

Key Concept

CompTIA 7-Step Malware Remediation Process
Question 435Question →

A desktop support technician at a municipal transit authority is responding to a Windows workstation infected with rogue adware and spyware. The technician has confirmed the malware symptoms, isolated the system from the local network, and disabled System Restore. Which of the following actions should the technician perform NEXT to adhere to the CompTIA standard malware remediation process?

Show answer & explanation

Answer: Update the anti-malware software signature files using a clean flash drive.

Answer

The technician should update the anti-malware software definitions using an offline source, such as a clean flash drive.
The CompTIA 7-step malware remediation workflow proceeds as follows: 1. Identify symptoms, 2. Quarantine system, 3. Disable System Restore, 4. Remediate infected systems (a. Update anti-malware software, b. Scan and remove), 5. Schedule scans and updates, 6. Enable System Restore and create restore point, 7. Educate end user. Since steps 1 through 3 are already completed, the next logical action is Step 4a: updating the anti-malware signature definitions.

Step-by-Step Solution

1
Identify current progress in the 7-step remediation process
Steps 1 (Identify), 2 (Quarantine/Isolate), and 3 (Disable System Restore) are complete.
Determines which step comes next in the established sequence.
2
Determine the next required step in sequence
Step 4 is Remediate infected systems, starting with updating anti-malware software/signatures (Step 4a).
Anti-malware software must have the latest signatures to effectively detect and remove modern threats.
3
Select the correct action matching Step 4a
Because network connectivity is disabled for quarantine, signatures must be updated via removable media.
Ensures the anti-malware database is current without rejoining the network prematurely.

Key Concept

CompTIA 7-Step Malware Remediation Process Order
Question 436Question →

A cybersecurity technician at a regional credit union is responding to a Windows 11 workstation exhibiting unauthorized background outbound traffic and rogue spyware pop-ups. The technician has confirmed the presence of malware on the system. Place the standard CompTIA remediation steps in the correct chronological order to resolve the incident.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of steps is: 1) Quarantine the infected workstation by disconnecting network cables and disabling wireless adapters; 2) Disable System Restore in Windows settings; 3) Update anti-malware signatures and perform a comprehensive system scan; 4) Re-enable System Restore and generate a clean system restore point; 5) Provide end-user security awareness training.
The standard CompTIA 7-step malware removal process follows a specific lifecycle: 1. Identify malware symptoms, 2. Quarantine infected systems, 3. Disable System Restore, 4. Remediate infected systems (a. Update anti-malware software, b. Scan and use removal techniques), 5. Schedule updates and run scans, 6. Enable System Restore and create a restore point, 7. Educate the user. The correct ordering strictly adheres to this workflow by isolating the endpoint first, disabling restore snapshots prior to cleaning, running updated anti-malware tools, re-enabling restore features once clean, and finishing with end-user education.

Step-by-Step Solution

1
Isolate the compromised system (Quarantine).
Network communication is severed, preventing lateral movement across the credit union network.
According to the CompTIA 7-step malware removal procedure, isolation/quarantine immediately follows identification.
2
Disable System Restore.
All existing restore points (which may contain infected files) are purged.
Disabling System Restore prevents Windows from accidentally restoring infected system files during recovery.
3
Remediate the system (Update engine and scan/remove malware).
Malware components are identified, quarantined, and deleted from the operating system.
Updating signature files first guarantees maximum detection capabilities before running removal scripts.
4
Enable System Restore and create a restore point.
A clean backup baseline is established for future operating system protection.
System protection should only be re-established after verification that all malicious software has been eliminated.
5
Educate the end user.
The workstation user learns safe browsing and email hygiene practices.
User education is the critical final step to prevent future vector exploitation.

Key Concept

CompTIA 7-step Malware Remediation Process
Question 437Question →

An IT support technician is deploying a shared workstation in a financial service firm's reception area. To protect sensitive client financial records from unauthorized exfiltration, company policy requires that standard users be restricted from reading or writing data to external flash drives, while essential USB peripherals such as keyboards and mice remain fully functional. Which of the following is the most effective workstation hardening action to fulfill this requirement?

Show answer & explanation

Answer: Configure Removable Storage Access policies in the Local Group Policy Editor to deny access to removable disks.

Answer

Configure Removable Storage Access policies in the Local Group Policy Editor to deny access to removable disks.
Configuring Removable Storage Access policies in the Local Group Policy Editor allows administrators to block read and write permissions specifically for USB flash drives and external disks while permitting USB Human Interface Devices (such as keyboards and mice) to operate normally.

Step-by-Step Solution

1
Analyze the technical requirements and constraints.
USB mass storage devices must be blocked to prevent data loss, but USB Human Interface Devices (HID) must remain operational.
Disabling the entire USB controller hardware would render the workstation unusable.
2
Identify the appropriate administrative tool and policy path.
Navigate to Local Group Policy Editor (gpedit.msc) under Computer Configuration -> Administrative Templates -> System -> Removable Storage Access.
Group Policy provides targeted control over device classes rather than global driver shutdown.
3
Apply the granular access restriction.
Enable policies such as 'Removable Disks: Deny read access' and 'Removable Disks: Deny write access'.
This selectively prevents storage mounting and data transfer while leaving peripheral input drivers unaffected.

Key Concept

Removable Storage Restriction via Local Group Policy
Estimated Time:1m 15s
Question 438Question →

A desktop support technician at a game development studio is responding to a workstation infected with spyware. The technician has successfully isolated the system from the network, disabled System Restore, updated the anti-malware definitions in Safe Mode, and executed a full scan that detected and removed all malicious files. Which of the following actions should the technician perform NEXT according to the standard CompTIA malware remediation process?

Show answer & explanation

Answer: Schedule recurring automatic anti-malware updates and system scans.

Answer

Schedule recurring automatic anti-malware updates and system scans.
The CompTIA 7-step malware remediation process follows a strict sequential order: 1. Identify malware symptoms, 2. Quarantine infected systems, 3. Disable System Restore, 4. Remediate infected systems (update anti-malware, scan/remove), 5. Schedule updates and scans, 6. Enable System Restore and create a restore point, 7. Educate the end user. Since Step 4 has just been completed, the technician must proceed to Step 5 by scheduling recurring automatic updates and scans.

Step-by-Step Solution

1
Review current progress in the CompTIA 7-step malware remediation process.
Steps 1 (Identify), 2 (Quarantine), 3 (Disable System Restore), and 4 (Remediate/Update/Scan) have been completed.
Determines the current phase of remediation.
2
Identify Step 5 of the remediation methodology.
Step 5 dictates scheduling recurring updates and automatic scans to prevent future reinfection.
Maintains ongoing protection on the remediated host.
3
Select the option that matches Step 5.
Scheduling recurring anti-malware updates and system scans is selected.
Matches the official CompTIA standard operating procedure.

Key Concept

CompTIA 7-Step Malware Remediation Process Order
Question 439Question →

A systems administrator is configuring local security policies for standalone Windows workstations deployed in a public library's computer lab. Which TWO of the following administrative actions should the technician perform to reduce the attack surface and harden these workstations against unauthorized access?

Select all that apply

Show answer & explanation

Answer: Disable the built-in local Guest account.; Configure AutoPlay and AutoRun settings to disabled for all removable drives.

Answer

The technician should disable the built-in local Guest account and disable AutoPlay/AutoRun settings for all removable drives.
Hardening standalone workstations in public or shared spaces requires limiting unauthorized default access and preventing automated execution of external media. Disabling the local Guest account removes an unneeded login vector, and turning off AutoPlay/AutoRun prevents untrusted USB devices from launching malicious code upon insertion.

Step-by-Step Solution

1
Identify default account vulnerabilities
Disabling the default local Guest account restricts unnecessary local access vectors for anonymous users.
Hardening best practices mandate removing or disabling unneeded default accounts to reduce potential entry points.
2
Configure media execution controls
Disabling AutoPlay/AutoRun stops code execution when removable storage devices are connected.
Publicly accessible kiosks are vulnerable to malicious USB drives carrying autorun payloads.

Key Concept

Workstation Hardening via Account Controls and Removable Media Policies
Estimated Time:1m 30s
Question 440Question →

An IT technician is preparing a standard workstation baseline image for remote customer support representatives. Company security policy requires hardening local user account settings to mitigate credential harvesting and unauthorized local access. Which of the following configuration steps should the technician perform to meet this security baseline requirement?

Show answer & explanation

Answer: Disable the built-in Guest account and rename the built-in local Administrator account.

Answer

Disable the built-in Guest account and rename the built-in local Administrator account.
Hardening default local accounts requires disabling unneeded accounts like Guest and renaming well-known default accounts like Administrator. This eliminates easy entry points for unauthorized users and disrupts automated password brute-force scripts targeting standard account names.

Step-by-Step Solution

1
Identify local account security risks
Default local accounts (such as Administrator and Guest) present known attack vectors for brute-force attacks and unauthorized access.
Attackers target well-known account names to gain initial access or elevate privileges on a machine.
2
Apply local account hardening best practices
Disable the built-in Guest account so it cannot be used for logon sessions, and rename the default Administrator account to a non-standard name.
This enforces principle of least privilege and obscures default administrative account identifiers.

Key Concept

Workstation Account Hardening
PreviousPage 22 / 23Next