Examkin

Soru

Zorluk: ZorMalware Detection, Removal, and Prevention

A field systems engineer is servicing a Windows workstation at a remote branch office after local endpoint monitoring software flagged rogue keylogger activity. The engineer has physically disconnected the machine from the network, verified that the host is fully quarantined, and downloaded the latest anti-malware definition signatures onto an isolated USB drive. Which step must the engineer perform NEXT in accordance with standard malware remediation procedures prior to executing the scan and removal process?

  1. Disable System Restore in Windows.Cevap
  2. B
    Schedule recurring anti-malware updates and daily background scans.
  3. C
    Create a new System Restore point to save the current driver configuration.
  4. D
    Execute `chkdsk /r` from an elevated command prompt to repair file system allocation tables.

Cevap

Disable System Restore in Windows before running the anti-malware remediation scan.
According to the official CompTIA 7-step malware remediation process, the exact sequence is: 1. Identify malware symptoms, 2. Quarantine infected systems, 3. Disable System Restore, 4. Remediate infected systems (update anti-malware signatures, scan, and remove), 5. Schedule updates and scans, 6. Enable System Restore and create a restore point, 7. Educate the end user. Since the system has already been quarantined and update files obtained, the required next step before performing the remediation scan is to disable System Restore.

Adım Adım Çözüm

1
Analyze the completed steps in the CompTIA 7-step malware remediation process.
Step 1 (Identify malware) and Step 2 (Quarantine infected systems) have already been completed.
The scenario states that the keylogger was identified, the host network connection was severed (quarantined), and definition updates were acquired.
2
Determine the mandatory next sequential step before scanning and removing the malware (Step 4).
Step 3 is disabling System Restore in Windows.
Disabling System Restore purges existing restore points and prevents Windows from automatically backing up infected binaries while removal tools are running.
3
Confirm why post-remediation steps must not be performed prematurely.
Scheduling updates (Step 5), creating new restore points (Step 6), and end-user education (Step 7) must occur only after successful remediation.
Performing post-remediation steps prior to scanning leaves active malware payloads in place and jeopardizes system recovery integrity.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Process Order
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Malware Detection, Removal, and Prevention

Bu konudan daha fazla soru