220-1102 Question 408
Single answerSpywareA user reports that their Windows 11 laptop has become noticeably slow, the web browser opens unknown toolbars, and search results are being redirected to advertising sites. The user says the problems started after installing a free PDF converter from a pop-up advertisement. You need to address the most likely cause while following malware-removal best practices. Which action should you take FIRST?
- A
Boot the system into Safe Mode and run updated anti-malware scans
- B
Replace the hard drive because browser redirection indicates drive failure
- C
Disable System Restore and immediately restore the laptop to a previous restore point
- D
Upgrade the browser to the latest version and clear cached files only
Show answer and explanation
Correct answer: A
Explanation
This scenario matches a common spyware/adware infection: performance degradation, unwanted toolbars, redirected searches, and infection after downloading freeware from a pop-up. On A+ Core 2, candidates are expected to recognize these symptoms and apply practical malware-removal steps. The best first action is to boot into Safe Mode and run updated anti-malware scans, because this limits malicious processes from loading and improves the chance of successful detection and cleanup. In real-world practice, technicians should also isolate the device from the network if needed, update anti-malware definitions, scan and remove/quarantine threats, verify full functionality afterward, and educate the user about avoiding untrusted downloads. This aligns with standard endpoint security best practices and CompTIA's malware remediation process: identify malware symptoms, isolate the affected system, remediate using appropriate tools, schedule scans and updates, and then restore and confirm system functionality.
- A. Correct.
Correct. The symptoms strongly suggest spyware or adware installed with bundled software. CompTIA malware-removal best practices begin by identifying the issue and then quarantining/isolating the system and remediating it with updated anti-malware tools. Booting into Safe Mode can prevent many malicious startup items from loading, making detection and removal more effective.
- B. Incorrect.
Incorrect. Browser redirection, unexpected toolbars, and pop-up-driven software installs are classic indicators of spyware/adware, not physical hard drive failure. Replacing the drive would not be the appropriate first troubleshooting step and would ignore the likely malware infection.
- C. Incorrect.
Incorrect. Although System Restore can sometimes be used later in recovery, it is not the first action here. Also, disabling System Restore before remediation is associated with certain older malware-cleaning procedures and is not the best initial step for this scenario. The priority is to contain and scan the system with current anti-malware tools.
- D. Incorrect.
Incorrect. Updating the browser and clearing cache may help with performance or minor browser issues, but these actions alone do not address installed spyware or adware components, browser helper objects, malicious extensions, or startup items causing the redirects and toolbars.