220-1102 Question 465
Single answer5. Update anti-malware softwareA technician is troubleshooting a Windows 11 laptop that is missing recent malware detections seen on other company systems. The anti-malware application is installed and real-time protection is enabled, but the last security intelligence update was 12 days ago. The user reports the laptop has been off the corporate network while traveling and is currently connected to a reliable internet connection. Which action should the technician take FIRST to provide the quickest improvement in protection?
- A
Run a full anti-malware scan immediately without changing any settings
- B
Update the anti-malware definitions/security intelligence, then run a scan
- C
Disable real-time protection so the update can install without file conflicts
- D
Uninstall and reinstall the anti-malware application to force a clean signature database
Show answer and explanation
Correct answer: B
Explanation
The key issue is that the anti-malware software is present and enabled, but its malware definitions/security intelligence are outdated. Best practice is to update anti-malware software before relying on it to detect current threats. In Microsoft documentation for Microsoft Defender Antivirus, current security intelligence updates are a core part of effective protection, and scans are more useful after those updates are applied. CompTIA A+ Core 2 expects technicians to recognize that outdated anti-malware software can leave systems exposed even when protection appears to be enabled. Therefore, the most appropriate first action is to update the anti-malware definitions/security intelligence and then run a scan.
- A. Incorrect.
Running a full scan with outdated definitions is not the best first step. The scan may miss newer threats because detection capability depends heavily on current signatures/security intelligence. A scan is appropriate after updating, but not before if the primary issue is stale malware definitions.
- B. Correct.
This is correct. If the anti-malware engine is functioning but the definitions/security intelligence are outdated, updating them first provides the fastest and most effective improvement in protection. After the update, running a scan helps check for any infections that may have been missed while the device was using old definitions.
- C. Incorrect.
Disabling real-time protection is not an appropriate first step and reduces security unnecessarily. Modern anti-malware products are designed to update while protection remains enabled. Turning protection off increases risk and does not address the root problem of outdated definitions.
- D. Incorrect.
Reinstalling the product is excessive given the scenario. The application is already installed, appears operational, and the main issue is that it has not received recent updates. Reinstallation takes more time, may not be necessary, and does not represent the quickest corrective action.