CompTIA A+ Core 2 (220-1202)Software TroubleshootingMedium
During malware remediation, immediately after a technician investigates and verifies that a workstation is infected, which step should be performed NEXT according to CompTIA best practice?
- AQuarantine the infected system
- BEnable System Restore
- CEducate the end user
- DSchedule automatic scans and updates
Show answer & explanationAnswer & explanation
Correct answer: A. Quarantine the infected system
Once malware is verified, the next step in the best-practice procedure is to quarantine the infected system by disconnecting it from the network, preventing further spread before any remediation begins.
Why the other options are wrong
- B. System Restore is re-enabled only after remediation is finished.
- C. Educating the user is the final step, performed after remediation is complete.
- D. Scheduling scans happens after the infection is actually removed.
Malware Removal — Quarantine Step
After verifying an infection, the infected system must be quarantined (isolated from the network) to stop the malware from spreading before remediation begins.
- Follows verification, precedes disabling System Restore
- Typically done by disconnecting network access
- Prevents lateral spread to other systems
Memory trick: Quarantine the sick patient before starting treatment