220-1102 Question 406
Single answerRootkitA user reports that their Windows 11 laptop is redirecting web searches to unfamiliar sites and disabling security tools shortly after startup. Task Manager briefly shows suspicious processes, but they disappear before the technician can investigate. A malware scan from within Windows finds nothing, yet the symptoms continue. The technician suspects a rootkit. Which action is the BEST next step to confirm and remediate the infection?
- A
Boot the laptop from trusted external media and run an offline anti-malware/rootkit scan before cleaning or rebuilding the system
- B
Open msconfig and disable all non-Microsoft startup items, then reboot and rescan from within Windows
- C
Run Disk Cleanup and delete temporary files, then update the browser and clear its cache
- D
Create a new local administrator account and delete the user's original profile to remove the malicious changes
Show answer and explanation
Correct answer: A
Explanation
This scenario points to a rootkit because the malware appears to evade detection during normal operation, interferes with security tools, and hides its processes. CompTIA A+ Core 2 objectives emphasize identifying malware types and using appropriate remediation methods. For suspected rootkits, a trusted offline scan is the best next step because rootkits can hook into the running OS and conceal files, processes, drivers, or registry activity from standard tools. Industry best practice also supports isolating the system from the network, preserving evidence if required by policy, scanning from a known-good environment, and reimaging the system if integrity cannot be trusted. Microsoft security guidance and common incident response practices both support offline scanning and, when necessary, full rebuilds for deeply embedded malware.
- A. Correct.
Correct. Rootkits are designed to hide themselves by operating at a low level in the OS, kernel, boot process, or drivers, which can prevent standard in-OS tools from detecting them. Booting from trusted external media and performing an offline scan is a best practice because the suspected rootkit is not active, making detection more reliable. If confirmed, the technician can then clean the system or, depending on severity and organizational policy, back up data and reimage the device.
- B. Incorrect.
Incorrect. Disabling startup items may help with ordinary adware or unwanted applications, but it is not the best next step for a suspected rootkit. Rootkits often load below normal user-mode startup processes and can remain hidden even when common startup entries are disabled. This choice reflects the misconception that all persistent malware is controlled through standard startup mechanisms.
- C. Incorrect.
Incorrect. Disk Cleanup, browser updates, and cache clearing may help with browser performance issues or some forms of adware symptoms, but they do not address a rootkit. The scenario includes hidden processes, disabled security tools, and clean scans from within Windows, which strongly suggests deeper system compromise rather than simple browser corruption.
- D. Incorrect.
Incorrect. Creating a new admin account or deleting the user's profile does not remove malware embedded in the operating system, boot records, or kernel-level components. This option reflects the misconception that malicious behavior tied to a user session is always profile-based. Rootkits commonly persist independently of any one user profile.