220-1102 Question 403
Select 22.4 Summarize types of malware and tools/methods for detection, removal, and prevention.A user reports that their Windows 11 laptop has become extremely slow and displays frequent pop-up security warnings urging them to buy a cleanup tool. The web browser opens to unfamiliar pages, and Task Manager briefly appears and then closes by itself. You suspect malware is actively interfering with normal troubleshooting. Which TWO actions should a technician take FIRST to improve the chances of detecting and removing the infection safely?
- A
Boot the system into Safe Mode and run updated anti-malware scans
- B
Disable System Restore permanently before doing anything else
- C
Disconnect the laptop from the network and internet
- D
Run Disk Cleanup to delete temporary files and browser cache
- E
Uninstall the user's web browser and reinstall it from the vendor site
Show answer and explanation
Correct answers: A, C
Explanation
The best initial response is to contain the system and then scan it in a way that limits malware activity. Disconnecting the laptop from the network reduces the risk of spread, remote control, additional payload downloads, and data loss. Booting into Safe Mode and running updated anti-malware tools improves the likelihood of successful detection and removal because fewer malicious services and startup items are active. This approach aligns with common incident-response and malware-removal best practices taught in CompTIA A+ Core 2: identify symptoms, quarantine infected systems, disable unnecessary startup behavior by using Safe Mode when appropriate, remediate with anti-malware tools, and then verify full system functionality. Microsoft security guidance and standard endpoint-security practices also emphasize isolation and scanning with current protection signatures as early steps in malware handling.
- A. Correct.
Correct. Booting into Safe Mode can prevent many nonessential startup items and malware processes from loading, making malicious software easier to detect and remove. Running updated anti-malware tools in this reduced environment is a standard best practice when malware is actively resisting removal or interfering with tools such as Task Manager.
- B. Incorrect.
Incorrect. Although restore points can sometimes contain infected files, disabling System Restore permanently is not an appropriate first action. In many standard malware-removal workflows, a technician focuses first on containment and scanning. System Restore may be addressed later as part of remediation, but removing a recovery option before assessment is not the best initial step.
- C. Correct.
Correct. Disconnecting the device from the network helps contain the threat by preventing further command-and-control communication, data exfiltration, malicious downloads, or spread to other systems. Isolation is one of the first steps in handling suspected malware on an endpoint.
- D. Incorrect.
Incorrect. Deleting temporary files may remove some nuisance files and can slightly speed up later scans, but it does not address active malware processes or containment. It is not one of the best first actions when the system shows signs of rogue security software or browser hijacking.
- E. Incorrect.
Incorrect. Reinstalling the browser may not remove the underlying malware, especially if the issue is caused by adware, a trojan, malicious startup entries, or system-level persistence. This action treats a symptom rather than the likely root cause.