Examkin

Security

442 soru

Tüm türler442Çoktan seçmeli224Çoklu seçim94Eşleştirme71Sıralama53
Soru 441Soru →

A workstation support technician at a pharmaceutical logistics facility is troubleshooting a Windows 11 workstation infected with a Trojan. The system has already been isolated from the network, and System Restore has been disabled. Which of the following actions should the technician take NEXT as part of the remediation process? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Update the local anti-malware signatures and scan engine to the latest available definitions.; Execute a thorough anti-malware scan using specialized tools to quarantine identified threats.

Cevap

The technician should update the local anti-malware signatures and scan engine, and execute a thorough anti-malware scan using specialized tools to quarantine identified threats.
According to the CompTIA 7-step malware remediation process, once the system is isolated (Step 2) and System Restore is disabled (Step 3), the technician must proceed to Step 4: Remediate the infected systems. Step 4 requires two key actions: first, updating the anti-malware signatures and engines, and second, executing a full scan using anti-malware tools to quarantine and remove the infection.

Adım Adım Çözüm

1
Identify the current phase of the CompTIA 7-step malware removal process.
The system has been identified (Step 1), isolated (Step 2), and System Restore has been disabled (Step 3). The next sequential phase is Step 4: Remediate the infected systems.
Remediation must follow isolation and disabling restore points to prevent malware from persisting in backups or spreading.
2
Determine the mandatory sub-steps required for system remediation (Step 4).
Step 4 consists of (a) updating anti-malware signatures/software and (b) scanning and using removal techniques (e.g., Safe Mode or standalone tools).
Outdated signatures may miss active malware variants, making an immediate update essential prior to running the scan.
3
Evaluate the choices to select the two actions corresponding to Step 4.
Updating anti-malware signatures and executing a thorough anti-malware scan are the correct next remediation steps.
Re-enabling System Restore (Step 6) and educating the end user (Step 7) are post-remediation steps.

Anahtar Kavram

CompTIA 7-Step Malware Remediation Process - Step 4: Remediate Infected Systems
Tahmini Süre:1m 30s
Soru 442Soru →

An IT security analyst is defining baseline workstation security standards to protect enterprise desktops against common attack vectors. Match each workstation security hardening control on the left with its corresponding risk mitigation objective on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Disabling NetBIOS over TCP/IP
Implementing Local Administrator Password Solution (LAPS)
Enforcing Application Allowlisting (AppLocker)
Configuring Screensaver Lock Timeout

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Disabling NetBIOS over TCP/IP matches with blocking LLMNR/NBT-NS spoofing; Implementing LAPS matches with mitigating lateral movement from reused local admin credentials; Enforcing Application Allowlisting matches with preventing execution of untrusted binaries; Configuring Screensaver Lock Timeout matches with preventing unauthorized session access to unattended devices.
Each security control targets a specific workstation vulnerability: disabling NetBIOS prevents broadcast name resolution spoofing; LAPS prevents credential reuse and lateral movement; AppLocker restricts binary execution to trusted software; screensaver timeout protects open physical sessions on idle machines.

Adım Adım Çözüm

1
Analyze the purpose of network protocol hardening controls
Disabling NetBIOS over TCP/IP eliminates unauthenticated broadcast name resolution traffic, neutralizing NBT-NS/LLMNR spoofing vectors.
Legacy protocols broadcast requests across the local subnet, which malicious actors on the segment can easily intercept.
2
Analyze local account privilege management solutions
LAPS ensures unique, randomized passwords for local administrator accounts on every endpoint.
If local administrator passwords are standard across machines, compromising one system leads to lateral movement across the entire network.
3
Analyze software execution restriction policies
AppLocker enforce allowlisting rules to block unauthorized executables, installers, and scripts.
Allowlisting operates on a default-deny principle, blocking malware or unauthorized software even if the user attempts to launch it.
4
Analyze physical and environmental workstation controls
Screensaver lock policies require user re-authentication after a set interval of system inactivity.
This control mitigates physical security risks when users leave their desks unattended without manually locking their operating system.

Anahtar Kavram

Workstation Hardening and Risk Mitigation
ÖncekiSayfa 23 / 23
Security Alıştırma Soruları — CompTIA A+ (Core 1 & Core 2) — Sayfa 23 | Examkin