A technician receives the Chief Executive Officer's (CEO's) Windows 10 laptop, which has been infected with malware. The technician wants to make sure best practices are followed for troubleshooting…

The correct answer is A. Disconnect the device from the network B. Identify and research the symptoms D. Scan and use removal techniques. CompTIA's malware remediation best-practice order is: (1) Identify and research malware symptoms (B) - understand what you're dealing with; (2) Quarantine the infected system (A) - disconnect from the network immediately to prevent the malware from spreading or communicating…

Hardware and network troubleshooting

Question

A technician receives the Chief Executive Officer's (CEO's) Windows 10 laptop, which has been infected with malware. The technician wants to make sure best practices are followed for troubleshooting and remediating the malware. Which of the following best practices should the technician perform FIRST in this scenario? (Choose three.)

Options

ADisconnect the device from the network
BIdentify and research the symptoms
CRestore the computer to the previous checkpoint
DScan and use removal techniques
ECreate a restore point
FEducate the end user
GSchedule scans and run updates

How the community answered

(52 responses)

A
85% (44)
C
4% (2)
E
2% (1)
F
2% (1)
G
8% (4)

Explanation

CompTIA's malware remediation best-practice order is: (1) Identify and research malware symptoms (B) - understand what you're dealing with; (2) Quarantine the infected system (A) - disconnect from the network immediately to prevent the malware from spreading or communicating with a command-and-control server; (3) Disable System Restore / create a restore point is step 3 in the CompTIA model - but creating a restore point (E) after infection could capture the malware in the restore point; (4) Remediate/scan and remove (D). Restoring to a previous checkpoint (C) skips proper identification, and educating the user (F) and scheduling scans (G) come after remediation. The three 'FIRST' steps are isolate, identify, and remediate.

Topics

#malware remediation#troubleshooting methodology#incident response#network isolation

Community Discussion

No community discussion yet for this question.

Full 220-1002 Practice