Exam 220-1102 topic 1 question 260 discussion

Actual exam question from CompTIA's 220-1102

Question #: 260
Topic #: 1

A Windows workstation that was recently updated with approved system patches shut down instead of restarting. Upon reboot, the technician notices an alert stating the workstation has malware in the root OS folder. The technician promptly performs a System Restore and reboots the workstation, but the malware is still detected. Which of the following BEST describes why the system still has malware?

A. A system patch disabled the antivirus protection and host firewall.
B. The system updates did not include the latest anti-malware definitions.
C. The system restore process was compromised by the malware.
D. The malware was installed before the system restore point was created.

Show Suggested Answer

Suggested Answer: D 🗳️

by FT786 at Sept. 18, 2023, 9:49 a.m.

Comments

Submit Cancel

hbro

10 months, 4 weeks ago

Selected Answer: C

Why disable system restore in step 3 of malware removal process if it cant affect the restore point

upvoted 1 times

...

Mamad66

1 year, 5 months ago

Selected Answer: D

System Restore points capture the system state at specific times. If the malware was already present before the creation of the restore point, it remains unaffected by the restoration.

upvoted 2 times

...

sam3210

1 year, 6 months ago

Selected Answer: D

If the malware was present on the system before the creation of the system restore point, performing a system restore will not remove the malware. System restore points capture a snapshot of the system at a specific point in time, including files and settings. If the malware was already on the system when the restore point was created, it will be retained during the restoration process.

upvoted 3 times

...

FT786

1 year, 10 months ago

D. The malware was installed before the system restore point was created. System Restore works by restoring the system files and settings to a previous state, but it does not remove files or programs that were installed before the creation of the restore point. If the malware was already present on the system before the restore point was created, it would not be removed by using System Restore. Therefore, the most likely reason the malware is still detected after performing a System Restore is that it was present on the system before the restoration point was established.

upvoted 3 times

...