220-1102 - Software Troubleshooting (22% of the exam) - Section 3.2

Troubleshoot common PC security issues and apply the best-practice malware-removal procedure.

Recognise PC security symptoms - redirected browser, unexpected pop-ups, certificate warnings, renamed system files, false antivirus alerts, and altered hosts files - and tie each to the underlying compromise. Apply the seven-step CompTIA malware-removal procedure in order: identify and verify symptoms, quarantine the system, disable System Restore, remediate, schedule scans and updates, re-enable System Restore and create a restore point, then educate the end user.

Malware removal stepsQuarantineSystem RestoreBrowser redirectionEnd-user education

Practice question for this objective

Free sampleSoftware Troubleshootinghard

In the best-practice malware-removal procedure, at which stage is System Restore re-enabled and a fresh restore point created?

AAs the first action, taken before the infected host is quarantined from the network.
BDuring remediation, running in parallel with the scan that removes the detected malware.
CAfter remediation and scheduled scanning are complete, but before the user is educated. Correct
DBefore the anti-malware definitions are updated and the removal scan is actually run.

System Restore is re-enabled and a new restore point created near the end of the procedure, after the system is confirmed clean and before user education. Re-enabling restore only after remediation and scheduled scanning guarantees the new restore point captures a clean state, so a future rollback cannot reintroduce the malware.

Why A is wrong: Tempting because a clean snapshot sounds prudent early, but creating a restore point before cleaning would just capture the infection.

Why B is wrong: Tempting because both touch the same system, but a point created mid-clean could archive files that are not yet fully removed.

Why C is correct: Correct: restore is re-enabled and a point created only once the system is verified clean, at step six, immediately before educating the user.

Why D is wrong: Tempting because it is late in the flow, but re-enabling restore before remediation risks snapshotting live malware.

See more 220-1102 practice questions, answers explained.

Exam traps in Software Troubleshooting

Answers that look right on this material and are not. Each one is a distractor from a different question in the 220-1102 bank for this domain.

Immediately after quarantining the system and before running any removal scans.
Why it is wrong: At quarantine the machine is still infected, so any restore point would capture the malware; System Restore stays disabled through remediation.
Quarantine the desktop by removing it from the network to prevent any lateral spread.
Why it is wrong: Quarantine is a real step and sounds cautious, but it belongs early in the procedure and has already been carried out before remediation.
Because System Restore reserves disk space that the anti-malware scan needs to run.
Why it is wrong: Tempting because scans do use disk space, but freeing space is not the reason; the concern is the contents of the restore points, not their size.

Examworthy is not affiliated with or endorsed by CompTIA. Original, blueprint-aligned practice material only.