CompTIA A+ Education & Occupational Skills Learning Path • Module 5

Endpoint Security and Malware Response

Apply applying least privilege, authentication, malware, and data-protection practices through approved procedures, objective verification, documentation, and escalation.

22 minutes80% mastery targetPractice—unlimited attempts

Enter your participant information to start activity tracking.

Learning outcomes

Explain the purpose of applying least privilege, authentication, malware, and data-protection practices.
Apply approved procedures to a realistic CompTIA A+ situation.
Verify results, document objective evidence, and escalate conditions outside authorized scope.

Apply the approved workflow

Follow the approved containment and escalation process for suspected malware. Never request, share, or record a user password. Reliable performance begins with correct identification, current instructions, safe conditions, and a clear understanding of authority.

Key points

Follow the approved containment and escalation process for suspected malware.
Never request, share, or record a user password.
Confirm scope and prerequisites before acting.

Verify, document, and communicate

Sanitize or destroy storage media using approved procedures. A task is not complete until the result is checked against the expected outcome and the record allows another authorized person to understand what occurred.

Key points

Sanitize or destroy storage media using approved procedures.
Record objective facts, actions, results, and unresolved risks.
Escalate exceptions promptly through the authorized channel.

Applied scenario

Endpoint Security and Malware Response: verify before proceeding

During an endpoint-support ticket affecting a user's ability to work, a CompTIA A+ support technician is completing the Endpoint Security and Malware Response module scenario. An identifier, instruction, measurement, or expected result does not agree with the available record. The task has a deadline, but proceeding without resolving the conflict could create safety, privacy, quality, compliance, or service risk. Decide how the task should continue and what evidence must be recorded.

Practice check

Apply what you learned

Answer all five questions. Feedback will identify what to review before you try again.

1Which action best supports applying least privilege, authentication, malware, and data-protection practices? Assume the network is at fault without checking local state and scope Follow the approved containment and escalation process for suspected malware. Install an unapproved tool because it produces a faster diagnosis Record only 'fixed' and omit symptoms, actions, results, and user communication

2Within Endpoint Security and Malware Response, what should happen before the participant proceeds? Use the most disruptive recovery option before trying supported lower-impact steps Ask the user to provide a password so the technician can sign in later Never request, share, or record a user password. Change several variables at once without recording a testable hypothesis

3For applying least privilege, authentication, malware, and data-protection practices, which closeout action provides the strongest evidence of reliable performance? Replace hardware before checking compatibility, power state, and evidence Close the ticket after the device starts without confirming the user's service Disable endpoint protection permanently to prevent another alert Sanitize or destroy storage media using approved procedures.

4During Endpoint Security and Malware Response, what is the best response when the result conflicts with expectations? Pause the task involving Endpoint Security and Malware Response, reconcile the evidence and requirements, and obtain authorized guidance before proceeding Skip backup and rollback planning because the repair is expected to be brief Handle internal components without the required ESD controls Erase incident evidence before following the approved malware process

5After work involving applying least privilege, authentication, malware, and data-protection practices, what should the complete task record communicate? Assume the network is at fault without checking local state and scope Record the facts for Endpoint Security and Malware Response, authorized actions, verification results, unresolved risks, and next responsible owner Install an unapproved tool because it produces a faster diagnosis Record only 'fixed' and omit symptoms, actions, results, and user communication

Reflection and workplace transferDescribe how you would apply verification and documentation during a CompTIA A+ task involving applying least privilege, authentication, malware, and data-protection practices.

← Return to CompTIA A+ Education & Occupational Skills Learning Path