60. After a security event, a technician removes malware from an affected laptop and disconnects the laptop from the network. Which of the following should the technician do to prevent the operating system from automatically returning to an infected state?
Answer: B
Disable System Restore to prevent the operating system from automatically returning to an infected state.
Disabling System Restore will ensure that any potentially infected restore points are removed, thereby preventing the operating system from reverting to a state that may still contain malware.
A) Enable System Restore.
Enabling System Restore after a security event could be counterproductive, as it may retain infected restore points. If the operating system were to revert to one of these points, it could reinfect the system, nullifying the technician's efforts to remove the malware.
B) Disable System Restore.
Disabling System Restore is necessary in this situation because it eliminates any restore points that may harbor malware. This action helps ensure that the system does not revert to a previous state that includes the infection, thus maintaining the integrity of the operating system post-removal.
C) Enable antivirus.
While enabling antivirus is a crucial step for ongoing protection against malware, it does not directly prevent the operating system from returning to an infected state after the malware has been removed. Without disabling system restore, the risk of re-infection remains if a malicious restore point exists.
D) Disable antivirus.
Disabling antivirus is an incorrect action, as it would leave the system vulnerable to further attacks. However, it does not address the specific concern of preventing the operating system from reverting to an infected state.
E) Educate the user.
Educating the user is a valuable strategy for long-term security awareness, but it does not provide a direct solution to the immediate problem of the operating system potentially reverting to an infected state through restore points.
Conclusion
Disabling System Restore is the most effective measure to prevent the operating system from reverting to an infected state after malware removal. All other options either fail to address the immediate risk of reinfection or could potentially exacerbate the situation. System integrity is best maintained by ensuring that no infected restore points remain available in the operating system.