220-802 · Question #872
A user states that their work PC has become infected with a virus. Which of the following should the technician do FIRST?
The correct answer is C. Remove the machine from the network. When a PC is confirmed to have a virus, the first priority is to isolate it from the network to prevent the malware from spreading to other systems or exfiltrating data.
Question
A user states that their work PC has become infected with a virus. Which of the following should the technician do FIRST?
Options
- APerform an antivirus program scan
- BBoot the machine into Safe Mode
- CRemove the machine from the network
- DCheck for system security patches
How the community answered
(33 responses)- A6% (2)
- B6% (2)
- C73% (24)
- D15% (5)
Why each option
When a PC is confirmed to have a virus, the first priority is to isolate it from the network to prevent the malware from spreading to other systems or exfiltrating data.
Running an antivirus scan is a remediation step that should only occur after the machine is isolated, since an active network connection could allow the malware to download updates or spread during the scan.
Booting into Safe Mode is a useful remediation technique but is a secondary step; the machine should be disconnected from the network before any remediation is attempted.
Removing the infected machine from the network - by disconnecting the Ethernet cable or disabling the wireless adapter - contains the threat and stops lateral movement to other networked devices. Containment is the first step in incident response before any remediation or scanning begins, following standard security frameworks such as NIST SP 800-61.
Applying security patches is a preventive and hardening measure, not an immediate incident response action for an already-infected system.
Concept tested: Malware incident response - containment first
Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
Topics
Community Discussion
No community discussion yet for this question.