220-1102 Malware Isolation Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Local Users and Groups

  Why it's wrong here

  Local Users and Groups is a Microsoft Management Console snap-in used to administer local user accounts and group memberships, such as resetting passwords, disabling accounts, or adding users to the Administrators group. For a service desk jump box, the immediate operational or security goal is not identity administration but rather containing a potential threat or diagnosing an active issue. While user management is an important administrative task, it does not address the need for rapid isolation or mitigation, making it an incorrect choice for this scenario.

• ✓

  malware isolation procedure

  Why this is correct

  Malware isolation procedure is correct because the immediate goal when supporting a jump box, especially one used by a service desk, is to contain any suspected infection before it spreads. Isolating the machine—such as disconnecting it from the network or using a hard cutoff—prevents malware from using the jump box as a pivot to compromise other systems, preserves forensic evidence, and aligns with incident response best practices. This direct containment action is the primary step when a jump box is believed to be compromised, making it the most appropriate choice.

• ✗

  Event Viewer

  Why it's wrong here

  Event Viewer is a read-only tool that provides detailed logs for system, security, and application events, which is useful for post-incident analysis or troubleshooting. However, it does not actively mitigate an ongoing threat or contain malware; it only offers insight after the fact. For a service desk jump box, the immediate need is to stop active damage or unauthorized access, not to review logs, so Event Viewer fails to address the stated goal directly.

• ✗

  System Restore

  Why it's wrong here

  System Restore reverts Windows system files, registry keys, and some installed programs to a previous restore point, which might undo certain changes caused by malware. However, it is not a reliable malware removal method, particularly for rootkits or fileless malware, and it can destroy volatile forensic evidence needed for investigation. Additionally, System Restore does not isolate the system from the network or prevent lateral movement, so it is unsuitable as an immediate action for a jump box security incident.

Go deeper

Related to this question