mediumMultiple Choice
220-1102 Practice Question: After a malware infection, a user's Windows 10 PC…
After a malware infection, a user's Windows 10 PC has several suspicious scheduled tasks that run at startup. Which administrative tool should you use to review and disable these tasks?
⚠ Common exam trap
The CompTIA A+ exam often tests the misconception that stopping a service or using a firewall rule can disable a scheduled task, but the correct approach is to use the Task Scheduler itself to manage the task entries directly.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Task Scheduler to examine the task library and disable suspicious entries.
The Task Scheduler (taskschd.msc) is the correct administrative tool to review and disable suspicious scheduled tasks because it provides a centralized library of all tasks, including their triggers, actions, and conditions. After a malware infection, attackers often create persistent scheduled tasks that run at startup; using Task Scheduler, you can navigate to the Task Scheduler Library, locate the malicious entries, and disable or delete them directly without affecting the core Task Scheduler service.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Services console to stop the 'Task Scheduler' service.
Why it's wrong here
Stopping the Task Scheduler service halts all scheduled tasks system-wide, including legitimate maintenance jobs, and the service typically restarts, so the malicious entries persist. Task Scheduler itself is the correct tool for reviewing and disabling individual tasks; the Services console manages service startup, not task definitions.
- ✓
Task Scheduler to examine the task library and disable suspicious entries.
Why this is correct
Task Scheduler exposes the Task Scheduler Library, where startup-triggered tasks created by malware are listed. Reviewing each task's action and trigger, then disabling suspicious entries, removes the persistence mechanism without deleting evidence needed for further analysis.
- ✗
Resource Monitor to see which tasks are currently running.
Why it's wrong here
Resource Monitor shows real-time CPU, disk, network and memory usage per process, offering no persistent list of scheduled tasks and no ability to disable them. It suits live performance troubleshooting. Reviewing and disabling startup tasks requires Task Scheduler, which exposes each task's triggers and actions.
- ✗
Windows Firewall with Advanced Security to block the tasks' network access.
Why it's wrong here
Windows Firewall with Advanced Security filters network traffic by port, protocol and address; it cannot enumerate or disable scheduled tasks, and blocking their outbound connections leaves the malicious tasks executing. Firewall rules are the right tool for restricting inbound or outbound traffic, not for removing persistence mechanisms.
Go deeper
Related to this question
Learn chapter
Troubleshoot: Corrupt User Profile
Key term
Windows 10
Windows 10 is a personal computer operating system developed by Microsoft that combines the familiarity of Windows 7 with the modern features of Windows 8, designed to run on a wide range of devices from desktops to tablets.
Key term
Malware
Malware is any software intentionally designed to cause damage, disrupt operations, steal data, or gain unauthorized access to computer systems.
About these practice questions
This 220-1202 question is part of Courseiva's 687-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.