220-1102 Question 456
Single answerUnpatched systemsA technician is troubleshooting repeated malware infections on several Windows 10 workstations in a small accounting office. The antivirus product is installed and active, but the systems have not received operating system updates for months because users frequently postpone reboots. A review shows the infections are exploiting a vulnerability that was already addressed by Microsoft in a prior security update. Which action should the technician take FIRST to reduce the risk of continued compromise?
- A
Deploy the missing security patches through the organization's update management process and schedule forced reboots outside business hours
- B
Disable the local firewalls on the workstations so the antivirus software can inspect all traffic without interruption
- C
Reimage all affected systems immediately and leave update settings unchanged to avoid user disruption
- D
Remove the antivirus software and replace it with an anti-malware scanner that runs only on demand
Show answer and explanation
Correct answer: A
Explanation
Unpatched systems are a major security risk because known vulnerabilities are often publicly documented and quickly targeted by malware and threat actors. In this scenario, the key clue is that the exploited weakness was already addressed in a Microsoft security update. The technician should prioritize patch deployment and ensure reboots occur so updates fully install. This aligns with common security best practices from Microsoft and industry guidance such as vulnerability management, patch management, and defense in depth. Antivirus is important, but it is not a replacement for OS and application updates. Firewalls, endpoint protection, and patching work together; removing or disabling one control does not compensate for another. In an A+ Core 2 context, the best first step is to remediate the missing patches and correct the process issue that prevented successful installation.
- A. Correct.
Correct. The scenario specifically identifies unpatched systems as the root issue: the malware is exploiting a vulnerability that has already been fixed by Microsoft. Applying the missing security updates is the most direct corrective action, and scheduling forced reboots addresses the operational reason patches were not completing. This follows standard patch management best practices: identify missing updates, deploy them, and ensure required restarts occur so protections take effect.
- B. Incorrect.
Incorrect. Disabling host firewalls would reduce security, not improve it. Local firewalls help limit unauthorized inbound and sometimes outbound traffic. Antivirus and firewall technologies serve different purposes, and turning off the firewall does not solve the unpatched vulnerability. Someone might choose this if they misunderstand layered security controls.
- C. Incorrect.
Incorrect. Reimaging may be necessary for severely compromised machines, but it does not address the ongoing underlying problem if update settings remain unchanged. The question asks what should be done FIRST to reduce continued risk, and patching the known vulnerability is the primary control. Reimaging without fixing patch compliance can lead to reinfection.
- D. Incorrect.
Incorrect. Removing the installed antivirus would weaken protection. An on-demand scanner does not provide continuous monitoring and does not remediate the exploited OS vulnerability. This option reflects the misconception that malware protection can substitute for timely operating system patching.