A computer belonging to an organization's CEO has been infected with malware. Which of the following should be done FIRST?

The correct answer is B. Disconnect the computer from the network. The first action should be to isolate the infected system to prevent the malware from spreading to other networked devices. Once containment is ensured, the organization can proceed with investigation and remediation steps such as determining data compromise and updating security

Submitted by klara.se· Apr 18, 2026Protection of Information Assets

Question

Options

AInvestigate whether data has been compromised.
BDisconnect the computer from the network.
CUpdate the antimalware signature on the computer.
DContact the appropriate law enforcement authorities.

How the community answered

(20 responses)

B
85% (17)
C
5% (1)
D
10% (2)

Explanation

The first action should be to isolate the infected system to prevent the malware from spreading to other networked devices. Once containment is ensured, the organization can proceed with investigation and remediation steps such as determining data compromise and updating security

Topics

#Malware Incident Response#Security Incident Handling#Containment#Network Security

Community Discussion

No community discussion yet for this question.

Full CISA Practice