Following instructions from the help desk, a company employee turns off a workstation that has a suspected ransomware infection. A technician is dispatched later to investigate the workstation…

The correct answer is A. Disconnect the network cable. Even though the workstation was already powered off, the technician's first physical action should be to disconnect the network cable before powering it back on to investigate. This quarantines the machine and prevents ransomware from spreading laterally to network shares…

Hardware and network troubleshooting

Question

Following instructions from the help desk, a company employee turns off a workstation that has a suspected ransomware infection. A technician is dispatched later to investigate the workstation. Which of the following should the technician perform FIRST?

Options

ADisconnect the network cable.
BDisable System Restore
CBoot into safe mode
DUpdate the antivirus software.
ERecover from a restore point

How the community answered

(25 responses)

A
72% (18)
C
8% (2)
D
16% (4)
E
4% (1)

Explanation

Even though the workstation was already powered off, the technician's first physical action should be to disconnect the network cable before powering it back on to investigate. This quarantines the machine and prevents ransomware from spreading laterally to network shares, communicating with command-and-control servers, or encrypting additional files if it resumes. Network isolation is always the first step in malware incident response before any scanning, safe-mode booting, or recovery attempts.

Topics

#ransomware#incident response#network isolation#malware removal

Community Discussion

No community discussion yet for this question.

Full 220-1002 Practice