220-1002 · Question #349
Several users at an office have noticed their computers have been behaving erratically over the past hour. A technician suspects there may be a network worm or a hardware failure because all the…
The correct answer is C. Quarantine the affected systems. When a network worm is suspected, the immediate priority is containment - quarantining the affected systems by disconnecting them from the network prevents the potential worm from spreading laterally to other machines. This follows the standard incident response principle of…
Question
Several users at an office have noticed their computers have been behaving erratically over the past hour. A technician suspects there may be a network worm or a hardware failure because all the affected computers were purchased together. Which of the following should the technician perform FIRST?
Options
- ADownload antivirus updates
- BUpdate the device drivers
- CQuarantine the affected systems
- DPerform hardware diagnostics
How the community answered
(27 responses)- A15% (4)
- B4% (1)
- C74% (20)
- D7% (2)
Explanation
When a network worm is suspected, the immediate priority is containment - quarantining the affected systems by disconnecting them from the network prevents the potential worm from spreading laterally to other machines. This follows the standard incident response principle of isolating before investigating. Downloading antivirus updates requires the machines to remain connected to the internet or network, which risks further propagation of malware. Updating device drivers addresses hardware-related issues but is premature before the nature of the problem is confirmed, and does nothing to contain an active infection. Performing hardware diagnostics is appropriate after isolation to rule out hardware failure as the cause, but should not happen before the network threat is contained. Quarantine first, then diagnose.
Topics
Community Discussion
No community discussion yet for this question.