Examkin

Security

442 questions

All types442Multiple choice224Multiple select94Matching71Ordering53
Question 441Question →

A workstation support technician at a pharmaceutical logistics facility is troubleshooting a Windows 11 workstation infected with a Trojan. The system has already been isolated from the network, and System Restore has been disabled. Which of the following actions should the technician take NEXT as part of the remediation process? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Update the local anti-malware signatures and scan engine to the latest available definitions.; Execute a thorough anti-malware scan using specialized tools to quarantine identified threats.

Answer

The technician should update the local anti-malware signatures and scan engine, and execute a thorough anti-malware scan using specialized tools to quarantine identified threats.
According to the CompTIA 7-step malware remediation process, once the system is isolated (Step 2) and System Restore is disabled (Step 3), the technician must proceed to Step 4: Remediate the infected systems. Step 4 requires two key actions: first, updating the anti-malware signatures and engines, and second, executing a full scan using anti-malware tools to quarantine and remove the infection.

Step-by-Step Solution

1
Identify the current phase of the CompTIA 7-step malware removal process.
The system has been identified (Step 1), isolated (Step 2), and System Restore has been disabled (Step 3). The next sequential phase is Step 4: Remediate the infected systems.
Remediation must follow isolation and disabling restore points to prevent malware from persisting in backups or spreading.
2
Determine the mandatory sub-steps required for system remediation (Step 4).
Step 4 consists of (a) updating anti-malware signatures/software and (b) scanning and using removal techniques (e.g., Safe Mode or standalone tools).
Outdated signatures may miss active malware variants, making an immediate update essential prior to running the scan.
3
Evaluate the choices to select the two actions corresponding to Step 4.
Updating anti-malware signatures and executing a thorough anti-malware scan are the correct next remediation steps.
Re-enabling System Restore (Step 6) and educating the end user (Step 7) are post-remediation steps.

Key Concept

CompTIA 7-Step Malware Remediation Process - Step 4: Remediate Infected Systems
Estimated Time:1m 30s
Question 442Question →

An IT security analyst is defining baseline workstation security standards to protect enterprise desktops against common attack vectors. Match each workstation security hardening control on the left with its corresponding risk mitigation objective on the right.

Click a left item, then click its matching right item

Items

Disabling NetBIOS over TCP/IP
Implementing Local Administrator Password Solution (LAPS)
Enforcing Application Allowlisting (AppLocker)
Configuring Screensaver Lock Timeout

Matches

Show answer & explanation

Answer

Disabling NetBIOS over TCP/IP matches with blocking LLMNR/NBT-NS spoofing; Implementing LAPS matches with mitigating lateral movement from reused local admin credentials; Enforcing Application Allowlisting matches with preventing execution of untrusted binaries; Configuring Screensaver Lock Timeout matches with preventing unauthorized session access to unattended devices.
Each security control targets a specific workstation vulnerability: disabling NetBIOS prevents broadcast name resolution spoofing; LAPS prevents credential reuse and lateral movement; AppLocker restricts binary execution to trusted software; screensaver timeout protects open physical sessions on idle machines.

Step-by-Step Solution

1
Analyze the purpose of network protocol hardening controls
Disabling NetBIOS over TCP/IP eliminates unauthenticated broadcast name resolution traffic, neutralizing NBT-NS/LLMNR spoofing vectors.
Legacy protocols broadcast requests across the local subnet, which malicious actors on the segment can easily intercept.
2
Analyze local account privilege management solutions
LAPS ensures unique, randomized passwords for local administrator accounts on every endpoint.
If local administrator passwords are standard across machines, compromising one system leads to lateral movement across the entire network.
3
Analyze software execution restriction policies
AppLocker enforce allowlisting rules to block unauthorized executables, installers, and scripts.
Allowlisting operates on a default-deny principle, blocking malware or unauthorized software even if the user attempts to launch it.
4
Analyze physical and environmental workstation controls
Screensaver lock policies require user re-authentication after a set interval of system inactivity.
This control mitigates physical security risks when users leave their desks unattended without manually locking their operating system.

Key Concept

Workstation Hardening and Risk Mitigation
PreviousPage 23 / 23
Security Practice Questions — CompTIA A+ (Core 1 & Core 2) — Page 23 | Examkin