Examkin

Soru

Zorluk: ZorMalware Detection, Removal, and Prevention

A tier-2 IT support technician is responding to a confirmed ransomware infection on an enterprise Windows workstation. Place the following remediation actions in the correct sequential order according to the standard CompTIA 7-step malware removal process.

  1. 1Disconnect the Ethernet cable and disable all wireless network adapters on the workstation.
  2. 2Disable System Protection in Windows settings to turn off System Restore.
  3. 3Boot the system into Safe Mode with Networking, update anti-malware signature files, and run a complete remediation scan.
  4. 4Re-enable System Protection and create a new clean system restore point.
  5. 5Conduct a mandatory training session with the user regarding social engineering and suspicious email links.

Cevap

The correct sequence follows the standard CompTIA 7-step malware removal process: 1. Quarantine infected system (disconnect network), 2. Disable System Restore, 3. Remediate infected system (update signatures and scan), 4. Enable System Restore and create restore point, 5. Educate the end user.
The CompTIA 7-step malware removal process follows a strict sequential order: 1. Identify malware symptoms, 2. Quarantine infected systems, 3. Disable System Restore, 4. Remediate infected systems, 5. Schedule scans and run updates, 6. Enable System Restore and create a restore point, and 7. Educate the end user. Disconnecting network interfaces (quarantine) must occur first to contain the infection. Disabling System Restore comes next to prevent malware from remaining in snapshot backups. Remediating with updated tools comes third. Re-enabling System Restore and creating a clean point occurs after remediation. User education is always the final step.

Adım Adım Çözüm

1
Isolate the infected host from the network environment.
Network communication is severed, stopping the malware from spreading to other subnet endpoints or connecting to command-and-control servers.
Quarantining the system is Step 2 in the CompTIA methodology.
2
Turn off System Restore / System Protection in Windows.
Existing restore points containing malicious payloads are deleted, preventing accidental re-infection upon restoration.
Disabling System Restore is Step 3 in the CompTIA methodology.
3
Update signature definitions and execute full anti-malware scan in an isolated environment.
Malicious binaries, registry keys, and background tasks are identified and purged.
Remediating the system is Step 4 in the CompTIA methodology.
4
Re-enable System Protection and generate a new restore point.
A known-good baseline state is saved for future recovery options.
Enabling System Restore and creating a restore point is Step 6 in the CompTIA methodology.
5
Provide security awareness education to the endpoint user.
The user understands attack vectors such as phishing links or suspicious attachments.
Educating the end user is Step 7 in the CompTIA methodology.

Anahtar Kavram

CompTIA 7-Step Malware Removal Process Sequence
Bu soruyu puanla

Konular

Malware Detection, Removal, and Prevention

Bu konudan daha fazla soru