220-1102 Question 461
Single answer1. Investigate and verify malware symptomsA technician is troubleshooting a Windows 11 laptop after a user reports that the browser opens to an unfamiliar search page, pop-up ads appear even when no browser window is open, and the system has become noticeably slower. Task Manager shows one browser process running after the user has closed all browser windows. Which of the following findings would BEST verify that the symptoms are caused by malware rather than normal application behavior or a misconfiguration?
- A
A review of installed browser extensions shows an unknown add-on that reinstalls itself after removal and is tied to a random-looking process in AppData
- B
Windows Update history shows that cumulative updates were installed the night before the symptoms began
- C
The user confirms that multiple tabs were open earlier in the day and the browser was configured to restore the previous session
- D
Storage settings show that the system drive has less than 10% free space remaining
Show answer and explanation
Correct answer: A
Explanation
The best answer is the finding that shows both suspicious persistence and unauthorized behavior: an unknown extension that reinstalls itself and is linked to a random executable in AppData. In A+ Core 2, technicians are expected to investigate and verify malware symptoms by distinguishing true indicators of compromise from ordinary system issues such as low storage, browser session restore settings, or recent patching. Common malware symptoms include browser redirection, unexpected pop-ups, degraded performance, unknown processes, and persistence mechanisms. Microsoft security guidance and standard incident response best practices emphasize looking for unauthorized startup items, suspicious processes, unusual browser add-ons, and executables running from temporary or user-profile paths. Those findings provide stronger verification than coincidence or general performance symptoms alone.
- A. Correct.
Correct. An unknown browser extension that reinstalls itself after removal is a strong malware indicator, especially when it is associated with a random-named executable running from a user-writable location such as AppData. This behavior aligns with common persistence mechanisms used by adware, browser hijackers, and potentially unwanted programs. The combination of unauthorized extension installation, persistence after removal, suspicious process naming, and execution from AppData is far more consistent with malware than with standard browser behavior.
- B. Incorrect.
Incorrect. Recent Windows updates can sometimes coincide with system changes or user complaints, but update history by itself does not verify malware. A timing correlation is not proof of malicious activity. In many cases, updates are legitimate and expected, so this finding could lead a technician away from the real issue if treated as confirmation.
- C. Incorrect.
Incorrect. Session restore can explain why a browser process or tabs might reappear, but it does not explain pop-up ads when the browser is closed, search hijacking, or persistent unauthorized behavior. This option reflects a plausible normal explanation for a leftover browser process, but it does not verify malware symptoms.
- D. Incorrect.
Incorrect. Low disk space can cause poor performance and sluggishness, which makes it a plausible distractor. However, it does not explain browser hijacking, self-reinstalling extensions, or pop-up ads appearing when no browser window is open. This is a performance issue, not evidence that malware is the root cause.