220-1102 Question 421
Single answerAntivirusA user reports that their Windows 11 laptop has become unusually slow and displays repeated pop-ups claiming the system is infected. The installed antivirus application will not open, and scheduled scans have not run for several days. You suspect malware is interfering with the antivirus software. Which action should the technician take FIRST to improve the chance of detecting and removing the infection?
- A
Boot the laptop into safe mode and run an updated anti-malware scan
- B
Disable User Account Control so the antivirus can run without prompts
- C
Uninstall the current antivirus application and continue using the system normally until a replacement is installed
- D
Delete temporary files and browser cache to remove the pop-ups
Show answer and explanation
Correct answer: A
Explanation
When malware is suspected of actively blocking antivirus tools, CompTIA A+ Core 2 objectives emphasize applying malware-removal best practices, including using anti-malware tools and limiting the malware's ability to run. Starting in safe mode is a common and practical first step because it loads a minimal set of drivers and services, which can prevent some malicious processes from launching. After booting into safe mode, the technician should update definitions if possible and run a full scan. Additional best practices include isolating the device from the network if needed, remediating the infection, and then verifying protection is restored. This aligns with standard guidance from Microsoft and major antivirus vendors, which commonly recommend safe mode or offline/remediation environments when malware interferes with security software.
- A. Correct.
Correct. Booting into safe mode can prevent many nonessential startup items and some malware processes from loading, which improves the likelihood that anti-malware tools can run successfully. Updating the signatures and performing a scan is a standard first response when malware appears to be actively interfering with the installed antivirus.
- B. Incorrect.
Incorrect. Disabling User Account Control reduces system security and does not address the root problem of malware tampering with antivirus processes. UAC is a protective feature, not the cause of the antivirus failure.
- C. Incorrect.
Incorrect. Removing the existing antivirus before confirming the infection is contained can leave the system with even less protection. Best practice is to isolate and scan the system first, then repair or replace security software afterward if needed.
- D. Incorrect.
Incorrect. Clearing temporary files or browser cache may remove some nuisance artifacts, but it is not an appropriate first step when malware is likely disabling antivirus and affecting system performance. This action does not reliably detect or remove active malware.