A user's PC is performing slowly after the user clicked on a suspicious email attachment. The technician notices that a single process is taking 100% of RAM, CPU, and network resources. Which of the…

The correct answer is A. Disconnect the computer from the network. When malware is suspected, the immediate priority is containment. Disconnecting the computer from the network stops the malware from spreading to other systems, communicating with a command-and-control (C2) server, or exfiltrating data. This is the first step in the CompTIA A+…

Security

Question

A user's PC is performing slowly after the user clicked on a suspicious email attachment. The technician notices that a single process is taking 100% of RAM, CPU, and network resources. Which of the following should the technician do first?

Options

ADisconnect the computer from the network
BRun an antivirus scan
CReboot the computer
DEducate the user about cybersecurity best practices

How the community answered

(37 responses)

A
70% (26)
B
16% (6)
C
5% (2)
D
8% (3)

Explanation

When malware is suspected, the immediate priority is containment. Disconnecting the computer from the network stops the malware from spreading to other systems, communicating with a command-and-control (C2) server, or exfiltrating data. This is the first step in the CompTIA A+ malware removal process: identify and quarantine. Running an antivirus scan (B) comes after isolation. Rebooting (C) could allow the malware to entrench itself further or clear volatile evidence. User education (D) is important but not an immediate incident response action.

Topics

#Malware#Incident Response#Network Isolation#System Performance

Community Discussion

No community discussion yet for this question.

Full 220-1102 Practice