220-1102 Question 611
Single answerApplication spoofingA user reports that a pop-up appeared while browsing, claiming to be a required browser update. The window used the browser's logo and prompted the user to download and run "Browser_Security_Update.exe." After the user installed it, the computer began displaying fake antivirus alerts and opening unwanted ads. Which action should the technician take FIRST to address this type of threat?
- A
Disconnect the computer from the network and begin malware remediation steps
- B
Open the browser and install the update again from the pop-up to verify whether it was legitimate
- C
Disable User Account Control so the user is not prompted by future update messages
- D
Clear the browser cache to remove the fake update notification
Show answer and explanation
Correct answer: A
Explanation
The scenario describes application spoofing: a malicious file disguised as a legitimate browser update. In A+ Core 2 security objectives, users are expected to recognize social engineering and malware delivery methods such as fake update prompts, rogue security software, and misleading application branding. The correct first action is containment by disconnecting the affected device from the network, followed by malware remediation. Best practices from major vendors, including Microsoft and browser developers, emphasize obtaining updates only from built-in update mechanisms or official vendor sites, not from pop-ups or third-party prompts. UAC should remain enabled because it helps prevent unauthorized changes, and browser cache clearing alone is insufficient once the user has already installed the malicious executable.
- A. Correct.
Correct. This is a classic application spoofing scenario, where malware imitates a legitimate application or update prompt to trick the user into installing malicious software. The first priority is containment: disconnect the system from the network to limit command-and-control communication, data exfiltration, and spread to other systems. After containment, standard malware remediation steps such as terminating malicious processes, updating antimalware tools, scanning, and removing or quarantining threats should follow.
- B. Incorrect.
Incorrect. Running the supposed update again increases the risk of further compromise. Application spoofing relies on the victim trusting logos, names, and familiar branding. A technician should verify software updates only through the vendor's official application, settings menu, or website, not by reusing a suspicious pop-up.
- C. Incorrect.
Incorrect. Disabling User Account Control reduces system security and makes it easier for malicious software to install with elevated privileges. UAC is a protection mechanism, not the cause of the problem. Turning it off would worsen the security posture rather than help remediate application spoofing.
- D. Incorrect.
Incorrect. Clearing the browser cache may remove some temporary files or stop a malicious page from reloading, but it does not address the installed malware. The scenario states the user already executed the fake update, and the system is now showing rogue alerts and ads, indicating active compromise beyond the browser cache.