mediumMultiple Choice
220-1102 Practice Question: A technician is removing malware from a Windows…
A technician is removing malware from a Windows 10 PC and wants to ensure that no remnants remain in the registry or startup folders. After running an antivirus scan and deleting infected files, which additional step should the technician perform?
⚠ Common exam trap
220-1202 often tests the misconception that an antivirus scan alone fully removes malware, when persistence mechanisms in the registry and startup folders must also be manually cleaned.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check and clean startup entries using MSConfig or Autoruns.
Malware frequently persists via registry Run keys, startup folders, and scheduled tasks that survive file deletion. After an antivirus scan removes the payload, remnants in these autostart locations can re-download or re-execute the malware. Using MSConfig or Sysinternals Autoruns to inspect and clean startup entries ensures no persistence mechanism remains, which is the correct remediation step.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Run the Windows Memory Diagnostic tool.
Why it's wrong here
Running the Windows Memory Diagnostic tool is a hardware diagnostic step designed to identify issues with the system's Random Access Memory (RAM), such as faulty modules or data corruption. While critical for system stability, this tool does not scan for, detect, or remove malware, nor does it address malware's ability to persist across reboots by modifying startup configurations. Therefore, it is entirely unrelated to the process of malware removal or preventing its re-execution.
- ✓
Check and clean startup entries using MSConfig or Autoruns.
Why this is correct
Checking and cleaning startup entries using utilities like MSConfig (System Configuration) or the more comprehensive Autoruns by Sysinternals is a crucial step in malware removal. Many malware strains establish persistence by adding entries to the Windows registry's Run keys, startup folders, or scheduled tasks, ensuring they automatically execute every time the system boots. Removing these malicious entries prevents the malware from reactivating after a reboot, effectively disrupting its ability to maintain control over the system.
- ✗
Disable System Restore to free up disk space.
Why it's wrong here
Disabling System Restore is primarily a measure to prevent malware from being restored from a previous restore point, or in some cases, to free up disk space by deleting existing restore points. However, this action does not directly address active malware processes or its persistence mechanisms, such as entries in startup folders or registry run keys, which allow it to re-execute upon system reboot. While it might be a secondary step in some advanced removal scenarios to ensure no clean restore points exist, it is not the primary method for preventing malware persistence.
- ✗
Update all device drivers to the latest versions.
Why it's wrong here
Updating all device drivers ensures optimal hardware performance, improves system stability, and can patch security vulnerabilities within the drivers themselves. However, this action does not directly scan for, quarantine, or remove existing malware files, nor does it modify the malicious entries that malware uses to establish persistence within the operating system's startup routines. Driver updates are a preventative security measure and maintenance task, not a direct malware remediation step for active infections or their auto-start configurations.
Go deeper
Related to this question
Learn chapter
Malware Types and Removal
Key term
Malware
Malware is any software intentionally designed to cause damage, disrupt operations, steal data, or gain unauthorized access to computer systems.
Key term
Registry
The Windows Registry is a central hierarchical database that stores configuration settings and options for the operating system, hardware, software, and user preferences.
About these practice questions
Courseiva writes every 220-1202 question from scratch — 687 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.