mediumMultiple ChoiceObjective-mapped
220-1202 Practice Question: A technician is removing malware from a Windows…
A technician is removing malware from a Windows 10 PC and wants to ensure that no remnants remain in the registry or startup folders. After running an antivirus scan and deleting infected files, which additional step should the technician perform?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check and clean startup entries using MSConfig or Autoruns.
After removing malware, it is critical to check and clean startup entries using tools like MSConfig or Autoruns to prevent the malware from reloading on reboot. Malware often adds entries to the registry Run keys or the Startup folder to persist. Simply deleting files may leave these entries intact, allowing the malware to reinstall itself.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Run the Windows Memory Diagnostic tool.
Why it's wrong here
Running the Windows Memory Diagnostic tool is a hardware diagnostic step designed to identify issues with the system's Random Access Memory (RAM), such as faulty modules or data corruption. While critical for system stability, this tool does not scan for, detect, or remove malware, nor does it address malware's ability to persist across reboots by modifying startup configurations. Therefore, it is entirely unrelated to the process of malware removal or preventing its re-execution.
- ✓
Check and clean startup entries using MSConfig or Autoruns.
Why this is correct
Checking and cleaning startup entries using utilities like MSConfig (System Configuration) or the more comprehensive Autoruns by Sysinternals is a crucial step in malware removal. Many malware strains establish persistence by adding entries to the Windows registry's Run keys, startup folders, or scheduled tasks, ensuring they automatically execute every time the system boots. Removing these malicious entries prevents the malware from reactivating after a reboot, effectively disrupting its ability to maintain control over the system.
- ✗
Disable System Restore to free up disk space.
Why it's wrong here
Disabling System Restore is primarily a measure to prevent malware from being restored from a previous restore point, or in some cases, to free up disk space by deleting existing restore points. However, this action does not directly address active malware processes or its persistence mechanisms, such as entries in startup folders or registry run keys, which allow it to re-execute upon system reboot. While it might be a secondary step in some advanced removal scenarios to ensure no clean restore points exist, it is not the primary method for preventing malware persistence.
- ✗
Update all device drivers to the latest versions.
Why it's wrong here
Updating all device drivers ensures optimal hardware performance, improves system stability, and can patch security vulnerabilities within the drivers themselves. However, this action does not directly scan for, quarantine, or remove existing malware files, nor does it modify the malicious entries that malware uses to establish persistence within the operating system's startup routines. Driver updates are a preventative security measure and maintenance task, not a direct malware remediation step for active infections or their auto-start configurations.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 220-1202 question from scratch — 495 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.