easyMultiple ChoiceObjective-mapped
220-1202 Practice Question: A customer reports that their Windows 10 laptop…
A customer reports that their Windows 10 laptop is displaying pop-up ads even when no browser is open. They suspect a malware infection. Which of the following should you do first to remediate this issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disconnect the network cable, boot into Safe Mode, then run a full antivirus scan.
The first step in malware remediation is to disconnect from the network to prevent further communication with command-and-control servers. Then boot into Safe Mode to prevent malicious processes from loading, and run a full antivirus scan. This isolates the threat before attempting removal.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Run a full antivirus scan while the system is connected to the internet.
Why it's wrong here
Running a full antivirus scan while the system remains connected to the internet is ill-advised because active malware could communicate with its command-and-control server. This connection allows the malware to download additional payloads, update its components to evade detection, or even receive remote commands to further compromise the system. Disconnecting from the network is a critical first step to contain the threat and prevent its spread or escalation.
- ✓
Disconnect the network cable, boot into Safe Mode, then run a full antivirus scan.
Why this is correct
This is the most effective initial remediation strategy. Disconnecting the network cable immediately isolates the infected system, preventing the malware from communicating with external servers, spreading to other devices, or receiving further instructions. Booting into Safe Mode loads only essential system services and drivers, often preventing malware from fully loading and executing, making it easier for antivirus software to detect and remove it without interference. Finally, a full antivirus scan can then thoroughly identify and eradicate the dormant or partially active threats.
- ✗
Perform a System Restore to a point before the pop-ups started.
Why it's wrong here
Performing a System Restore is generally insufficient for comprehensive malware removal. While it can revert system files and registry settings to a previous state, many sophisticated malware strains are designed to persist outside of the System Restore points, often residing in user profiles, program data, or even infecting the restore points themselves. Furthermore, System Restore does not scan for or remove malicious executables or data files, leaving the system vulnerable to reinfection or continued compromise.
- ✗
Immediately reinstall Windows 10 to ensure complete removal.
Why it's wrong here
Immediately reinstalling Windows 10, while effective for complete eradication, is an overly drastic and time-consuming first step. This process involves significant data backup and restoration, reinstallation of applications, and reconfiguration of settings, which is often unnecessary if the infection can be resolved through less intrusive means. Reinstallation should be reserved as a last resort when other containment and removal methods have failed, or if the integrity of the operating system is severely compromised beyond repair.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 220-1202 question from scratch — 495 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.