Exam 220-1002 topic 1 question 93 discussion

Answer D is correct. Look at this question from a reputable, industry-recognized trainer: A factory worker suspects that a legacy workstation is infected with malware. The workstation is running Windows XP and is used as part of an ICS/SCADA system to control some industrial factory equipment. The workstation is connected to an isolated network that cannot reach the internet. The workstation receives the patterns for the manufactured designs through a USB drive. A technician is dispatched to remove the malware from this workstation, and after its removal, the technician provides the factory worker with a new USB drive to move the pattern files to the workstation. Within a few days, the factory worker contacts the technician again to report the workstation appears to be reinfected with malware. Which of the following steps did the technician MOST likely forget to perform to prevent a reinfection? A- Disable System Restore (in Windows) B- Quarantine the infected system C- Enable System Restore and create a restore point (in Windows) D- Update the anti-malware solution (CORRECT) E- Remediate the infected systems F- Identify and research malware symptoms

I agree Disabling System Restore is part of procedure of removing a malware but in this case the system was never restored so the cause of the Malware is not System Restore so its more important and anti malware checking at this point, don't get me wrong Disabling System Restore is super important but to get rid of the malware requires checking

so the tech removed the virus and transferred the once-infected files to a new USB but did not scan and clean the new USB device... My gut says B

C. Disable System restore and remove all restore points from the system

I think it is C, the computer is isolated in a testing environment and the USB drive has been replaced with a new one, so how did it get the same malware again? Because the malware is already in the System Restore... the malware probably came initially via the old USB drive. And now the malware has been saved in the System Restore and no one noticed it until now.

I am honestly not strong at this area but is not the answer C? Reoccurence of malware on an isolated device after the removal. That sounds to me the malware is not removed completely. Is it possible that system restore was not considered in the removal process?

end-of-life OS

Option A is correct,

D is the correct answer because the questions does not state any restore points made, so the fist thing to do you suppose to update antivirus and then clean the PC then you can remove restore points and create a new restore point

A couple of questions back there was a similar question, but then the answer was updating the OS instead of updating the antivirus. Now it's the other way around. Doesn't make sense

D is a good answer but even with a new usb it could be B as files could contain the malware regardless, which could reinfect the system, question is a little vague.

I agree with all how would the virus likely to return, unless the actual files the user is transferring has malware on, I feel they could of been more distinct

I agree with you. Disabling System Restore is an important step in malware removal.

Especially since its an isolated system with a brand new USB drive

Is it not C as opposed to D, because its the same symptoms again ? "C. Disable System restore and remove all restore points from the system"