A helpdesk technician is responding to an incident involving a Windows workstation infected with a persistent crypto-mining Trojan. The malware infection has already been identified and verified by security logs. Place the following remediation actions in the correct sequence according to the official CompTIA 7-step malware removal process.
- 1Disconnect the computer from both the wired and wireless networks to isolate the machine.
- 2Disable System Restore in Windows to purge existing restore points containing infected files.
- 3Update anti-malware definition signatures and run a comprehensive system scan in Safe Mode.
- 4Re-enable System Restore and construct a new, clean system restore point.
- 5Conduct security awareness training with the workstation user regarding safe browsing and download habits.
Cevap
The correct chronological sequence following the CompTIA 7-step malware removal methodology is: 1) Disconnect the computer from networks (Quarantine), 2) Disable System Restore, 3) Update anti-malware signatures and scan in Safe Mode (Remediate), 4) Re-enable System Restore and create a clean restore point, and 5) Educate the end user.
The standard CompTIA 7-step malware removal process follows a specific lifecycle: 1. Identify malware symptoms, 2. Quarantine infected systems, 3. Disable System Restore, 4. Remediate infected systems (a. Update anti-malware software, b. Scan and use removal techniques), 5. Schedule updates and enable automated scans, 6. Enable System Restore and create a restore point, 7. Educate the end user. Arranging the actions from isolation (quarantine) through disabling System Restore, updating/scanning, re-enabling System Restore, and finishing with user training strictly satisfies this workflow.
Adım Adım Çözüm
Anahtar Kavram
CompTIA 7-Step Malware Removal Process