A user reports that the workstation's mouse pointer is moving and files are opening automatically. Which of the following should the user perform?

The correct answer is D. Contact the incident response team for direction. Spontaneous mouse movement and files opening on their own are strong indicators of a remote access trojan (RAT) or unauthorized remote control of the workstation. This is a potential security incident, not a technical glitch. The correct action is to contact the incident…

Enterprise Security

Question

Options

AUnplug the network cable to avoid network activity.
BReboot the workstation to see if problem occurs again.
CTurn off the computer to avoid any more issues.
DContact the incident response team for direction.

How the community answered

(27 responses)

A
4% (1)
B
7% (2)
C
4% (1)
D
85% (23)

Explanation

Spontaneous mouse movement and files opening on their own are strong indicators of a remote access trojan (RAT) or unauthorized remote control of the workstation. This is a potential security incident, not a technical glitch. The correct action is to contact the incident response team immediately so they can investigate, contain, and remediate the threat using proper forensic procedures. Rebooting (B) could destroy evidence. Simply unplugging the cable (A) or turning off the computer (C) may be part of containment, but only if directed by the incident response team - acting without guidance could interfere with the investigation or violate the organization's incident response policy.

Topics

#incident response#remote access attack#security awareness#escalation

Community Discussion

No community discussion yet for this question.

Full CAS-001 Practice