220-1102 Question 411
Single answerBoot sector virusA technician is troubleshooting a Windows workstation that fails to boot normally after a user connected an old USB drive from home. The system intermittently displays startup errors before Windows loads, and the antivirus software reports a possible boot sector infection. After backing up the user's accessible data, which action should the technician take NEXT to best remediate the issue?
- A
Boot from trusted recovery or antivirus media and scan or repair the boot records before attempting normal startup
- B
Run Disk Cleanup from Safe Mode to remove temporary files and then reboot
- C
Disable System Restore so the infected restore points are deleted immediately
- D
Reinstall the user's office applications because startup errors often come from corrupted program files
Show answer and explanation
Correct answer: A
Explanation
Boot sector viruses infect the area of a disk used to start a computer, such as the MBR or partition boot sector. Because this malware can load before the operating system, the best practice is to avoid booting from the infected drive when possible and instead use known-good recovery or antivirus media for offline scanning and repair. In a CompTIA A+ Core 2 context, the practical sequence is identify symptoms, isolate the issue, back up data if possible, remediate using trusted tools, and then verify normal operation. Microsoft recovery environments and major endpoint security vendors support offline scanning and startup repair workflows specifically because boot-level malware can evade or interfere with normal in-OS detection. The key applied concept is that boot sector infections require boot-path remediation, not file cleanup or application reinstallation.
- A. Correct.
Correct. A boot sector virus targets the boot record area used during system startup, so remediation should begin from trusted external media rather than the potentially infected local boot process. Using recovery media or reputable offline antivirus tools allows the technician to scan and repair the master boot record (MBR), volume boot record, or related startup components safely. This is the most appropriate next step after data backup when a boot sector infection is suspected.
- B. Incorrect.
Incorrect. Disk Cleanup removes temporary files and other nonessential data, but it does not address malicious code in the boot sector or startup records. A candidate might choose this because general cleanup is sometimes part of troubleshooting, but it does not remediate boot-level malware.
- C. Incorrect.
Incorrect. System Restore can be relevant in malware recovery in some cases, but disabling it is not the best next step for a suspected boot sector virus. The infection occurs before the operating system fully loads, so restore points are not the primary concern. A technician should first use trusted external tools to detect and repair the boot infection.
- D. Incorrect.
Incorrect. Reinstalling office applications does not address malware embedded in the boot process. This distractor reflects the misconception that startup issues are usually caused by damaged application files. In this scenario, the symptoms occur before Windows loads, which points to a lower-level boot problem rather than an application-layer issue.