mediumMultiple ChoiceObjective-mapped
220-1202 Practice Question: A technician is tasked with removing a persistent…
A technician is tasked with removing a persistent malware infection that survives reboots and re-infects the system even after a full antivirus scan in Safe Mode. The malware appears to hide in the Master Boot Record (MBR). Which removal method should the technician use?
⚠ Common exam trap
The 220-1202 exam often tests the misconception that antivirus scans in Safe Mode can remove all malware, but the trap here is that MBR-based infections load before the OS and require boot-level repair tools like `bootrec /fixmbr` to be eradicated.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the Windows Recovery Environment to run bootrec /fixmbr.
The malware is hiding in the Master Boot Record (MBR), which is the first sector of the boot drive and loads before the operating system. Running `bootrec /fixmbr` from the Windows Recovery Environment (WinRE) overwrites the MBR code with a clean Windows bootloader, effectively removing the malware that persists there. This method targets the infection at its source, unlike antivirus scans that run after the OS loads and cannot access the MBR while it is in use.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Run a system file checker (sfc /scannow) from within Windows.
Why it's wrong here
Running a System File Checker (sfc /scannow) from within Windows is ineffective against Master Boot Record (MBR) malware. SFC's primary function is to scan and repair protected Windows system files, which reside within the operating system's file structure. The MBR, however, is a critical boot sector located outside the file system on the hard drive, meaning SFC cannot detect, access, or repair any malicious code residing there. Furthermore, if the malware is active, running SFC from within the compromised OS might yield unreliable results.
- ✓
Use the Windows Recovery Environment to run bootrec /fixmbr.
Why this is correct
Using the Windows Recovery Environment (WinRE) to run `bootrec /fixmbr` is the correct approach because this command specifically targets and overwrites the Master Boot Record (MBR) with a clean, standard MBR. This action effectively eradicates any malware that has infected or modified the MBR, preventing it from loading during system startup. Performing this operation from WinRE ensures the operating system is not running, allowing for a clean and unhindered repair of the critical boot sector.
- ✗
Perform a clean installation of Windows without formatting the drive.
Why it's wrong here
Performing a clean installation of Windows without formatting the drive is insufficient to remove persistent MBR malware. While a clean install replaces the operating system files, it typically leaves the existing partition structure and, crucially, the Master Boot Record (MBR) untouched. If the malware has infected the MBR, it will persist and continue to load before the newly installed Windows, rendering the reinstallation ineffective. Formatting the drive is a necessary step to ensure complete eradication of MBR-level infections.
- ✗
Disable System Restore and delete all restore points.
Why it's wrong here
Disabling System Restore and deleting all restore points will not address an MBR infection. This action primarily removes saved system states and configuration files stored within the System Volume Information folder, preventing potential reinfection from a compromised restore point. However, System Restore operates at the operating system level and has no impact on the Master Boot Record (MBR) or other boot sectors, which are located outside its scope of protection and restoration capabilities. Therefore, MBR-resident malware would remain active.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 220-1202 question from scratch — 495 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.