An office computer has been infected with malware. Which of the following steps should be taken FIRST?

The correct answer is C. Quarantine the infected computer. The first step in any malware incident response is to quarantine (isolate) the infected machine by disconnecting it from the network. This prevents the malware from spreading laterally to other systems, communicating with command-and-control servers, or exfiltrating data. Only…

Hardware and network troubleshooting

Question

Options

ABack up the hard drive
BEducate the user
CQuarantine the infected computer
DRun antivirus software

How the community answered

(55 responses)

A
2% (1)
B
4% (2)
C
95% (52)

Explanation

The first step in any malware incident response is to quarantine (isolate) the infected machine by disconnecting it from the network. This prevents the malware from spreading laterally to other systems, communicating with command-and-control servers, or exfiltrating data. Only after isolation should the technician proceed with backing up, scanning, or remediation steps. Running antivirus first without isolating the machine risks further spread. Educating the user and backing up the drive are important steps but come later in the remediation process.

Topics

#malware response#quarantine#incident response#first response steps

Community Discussion

No community discussion yet for this question.

Full 220-1002 Practice