Can malware be installed before the creation of the System Restore point?

I'm taking a practice test for the CompTia Core 2 exam and I ran across a question that looks like this:

After performing a System Restore on a Windows workstation that was affected by malware, the technician notices that the malware is still detected. Which of the following BEST explains why the system still has malware?

A. The antivirus protection and host firewall were disabled by a system patch

B. The system updates did not include the latest anti-malware definitions …

can comptia comptia core cybersecurity exam malware performing point practice question restore system test windows workstation