220-1102 Question 460
Single answer2.6 Given a scenario, implement procedures for basic small office/home office (SOHO) malware removal.A technician is helping a home-based accountant whose Windows 11 laptop suddenly displays constant pop-ups, runs very slowly, and opens unfamiliar browser tabs on startup. The accountant says the system contains client tax records and must be cleaned without risking additional exposure to the network. Which action should the technician take FIRST as part of proper SOHO malware-removal procedure?
- A
Disconnect the laptop from the network to isolate it before continuing remediation
- B
Run Disk Cleanup to remove temporary files and improve performance before investigating further
- C
Back up all user files to a shared network drive so they are preserved during cleanup
- D
Uninstall the web browser because the pop-ups indicate the browser application is corrupted
Show answer and explanation
Correct answer: A
Explanation
CompTIA A+ Core 2 objective 2.6 emphasizes following a structured malware-removal process rather than jumping directly to cleanup steps. A commonly taught best-practice sequence is: identify malware symptoms, quarantine the infected system, disable System Restore on infected systems, remediate/update anti-malware tools, scan and remove threats, schedule scans and updates, re-enable System Restore/create a restore point, and educate the end user. In a SOHO setting, immediate isolation is especially important because devices often share the same router, NAS, printer, and internet connection, increasing the risk of spread or data exposure. This question focuses on the correct FIRST action: containment before remediation.
- A. Correct.
Correct. The first step in basic malware-removal procedure is to identify symptoms and quarantine or isolate the affected system to prevent the malware from spreading, communicating outward, or infecting shared resources. In a SOHO environment, disconnecting Wi-Fi or unplugging Ethernet is a practical first action before further steps such as disabling System Restore, remediating, scheduling scans, and educating the user.
- B. Incorrect.
Incorrect. Disk Cleanup may remove temporary files, but it is not the first response to suspected malware. The immediate priority is containment. Cleaning temp files can come later as part of remediation or performance recovery, but doing so first does not stop possible lateral movement or data exfiltration.
- C. Incorrect.
Incorrect. Backing up files to a shared network drive before isolating the device could copy malicious files, scripts, or infected documents to another system or shared storage. In standard malware-removal procedure, the device should first be isolated. Backups may still be appropriate later, but not before containment and assessment.
- D. Incorrect.
Incorrect. Pop-ups and unwanted browser behavior can be caused by malware, malicious extensions, adware, or altered startup settings. Uninstalling the browser does not address the root cause and is not the first step in a structured remediation process. This option reflects a common misconception that the visible application is necessarily the source of the infection.