Examkin

Soru

Zorluk: Çok zorMalware Detection, Removal, and Prevention

An incident responder is investigating a compromised Windows 11 workstation where a trojan dropper disabled local security services and established persistence in system boot configurations. The machine has already been isolated from the network and quarantined. Following the standard CompTIA malware remediation process, which TWO actions should the responder execute immediately prior to performing the system remediation scan? (Select TWO.)

  1. Turn off System Protection to prevent malicious files from persisting in restore points.Cevap
  2. Deploy updated antivirus definition signatures from a clean external drive.Cevap
  3. C
    Run `chkdsk /r /f` at an elevated command prompt to repair infected storage sectors.
  4. D
    Establish an automated scan policy in Windows Task Scheduler.

Cevap

The technician must turn off System Protection to purge infected restore points and deploy updated antivirus definition signatures from a clean external drive.
Disabling System Protection ensures that restore points containing infected files are purged and cannot be accidentally restored later. Updating malware definitions offline ensures the anti-malware engine has the newest threat signatures to detect and clean persistent trojan binaries without reconnecting the compromised host to the network.

Adım Adım Çözüm

1
Verify current stage in the CompTIA 7-Step Malware Remediation Process.
The workstation is already quarantined (Step 2 completed). The next required step before remediation scanning is Step 3.
Step 3 dictates disabling System Restore to ensure infected files are not archived into system recovery points.
2
Identify pre-scan remediation requirements (Step 4 prep).
The anti-malware tools must be updated before executing the scan.
Since the machine is disconnected from the network, signatures must be updated manually via clean external media.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Process - Steps 3 & 4 (Disable System Restore and Update Definitions)
Bu soruyu puanla

Konular

Malware Detection, Removal, and Prevention

Bu konudan daha fazla soru