mediumMultiple ChoiceObjective-mapped
CAS-004 Practice Question: A small business runs its critical…
A small business runs its critical line-of-business application on a single Windows server located in a local data center. The server is accessed by employees remotely via RDP over a VPN. Recently, the server has been experiencing slow performance, and the administrator notices high CPU usage from a process named 'svchost.exe'. The administrator suspects malware but is not sure. The business has no security tools beyond Windows Defender. Management wants to minimize downtime and ensure the server is back to full operation as soon as possible. Which of the following is the BEST course of action for the administrator to take first?
⚠ Common exam trap
CompTIA often tests the principle of 'least disruption first' combined with 'clean environment scanning,' where candidates mistakenly choose immediate network isolation (Option D) or backup restoration (Option B) without first using a low-impact diagnostic tool like an offline scan.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Run a full offline scan using Microsoft Defender (Windows Defender Offline) from a bootable media.
A full offline scan using Microsoft Defender Offline boots the server from a clean environment, bypassing the running operating system where malware can hide or resist detection. This approach directly addresses the suspected malware without relying on the compromised OS, minimizes downtime by avoiding unnecessary restoration or network changes, and uses the only security tool available (Windows Defender) effectively.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Run a full offline scan using Microsoft Defender (Windows Defender Offline) from a bootable media.
Why this is correct
Can detect and remove malware without affecting the running system, minimizing downtime.
- ✗
Restore the server from the most recent backup taken before the performance issues started.
Why it's wrong here
May reintroduce the same malware if the backup is infected.
- ✗
Install a third-party antivirus solution and perform a full system scan.
Why it's wrong here
Could conflict with Defender and cause further issues.
- ✗
Disconnect the server from the network immediately to contain any potential threat.
Why it's wrong here
Stops the attack but does not clean the system and causes downtime.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.