220-1102 · Question #495
A technician has verified a computer is infected with malware. The technician isolates the system and updates the anti-malware software. Which of the following should the technician do next?
The correct answer is D. Run repeated remediation scans until the malware is removed. After isolating an infected system and updating anti-malware software, the technician should next run repeated remediation scans to thoroughly remove all traces of malware.
Question
A technician has verified a computer is infected with malware. The technician isolates the system and updates the anti-malware software. Which of the following should the technician do next?
Options
- ARun one scan and schedule future scans.
- BBack up the uninfected files and reimage the computer.
- CRestore the clean backup copies of the infected files.
- DRun repeated remediation scans until the malware is removed.
How the community answered
(31 responses)- A6% (2)
- B3% (1)
- C16% (5)
- D74% (23)
Why each option
After isolating an infected system and updating anti-malware software, the technician should next run repeated remediation scans to thoroughly remove all traces of malware.
Running only one scan might miss residual malware components, and while scheduling future scans is good practice, it doesn't address the immediate need for thorough remediation.
Backing up uninfected files and reimaging is a common last resort or preferred method in some organizations for confirmed infections, but typically comes after attempts at remediation have failed or if data integrity is paramount. It's not the immediate next step after updating definitions and before attempting removal.
Restoring clean backup copies of infected files is a recovery step, usually after malware has been removed or the system reimaged, to restore lost or corrupted user data, not a direct malware removal technique itself.
Running repeated remediation scans until the malware is removed is the next logical step. Malware can be complex, often hiding in multiple locations or using rootkit techniques, so a single scan might not catch everything. Multiple scans, possibly with different tools or in different modes (e.g., safe mode), increase the likelihood of complete eradication.
Concept tested: Malware incident response - remediation phase
Topics
Community Discussion
No community discussion yet for this question.