CompTIA A+ Core 2 (220-1202)SecurityMedium
A technician is troubleshooting a Windows 11 workstation that is experiencing slow performance and unexpected crashes. Upon inspection, they find that Windows Defender has been disabled, and a significant amount of CPU and memory resources are being consumed by an unknown process running in the background. What is the most likely initial step the technician should take given these symptoms?
- AReinstall the operating system to ensure a clean slate.
- BDisconnect the workstation from the network.
- CImmediately re-enable Windows Defender and run a full scan.
- DCheck for available Windows updates and install them.
Show answer & explanationAnswer & explanation
Correct answer: B. Disconnect the workstation from the network.
The symptoms (disabled Defender, unknown resource-consuming process, slow performance, crashes) strongly suggest a malware infection. The most critical *initial* step in malware removal is to disconnect the infected system from the network to prevent the malware from spreading to other systems or exfiltrating data, before attempting further analysis or removal.
Why the other options are wrong
- A. Reinstalling the OS is a drastic measure and typically a last resort after attempting removal; it's not the initial step.
- C. Re-enabling Defender and scanning is a good *next* step, but isolating the system first is paramount to prevent further damage or spread.
- D. Checking for updates is generally good practice but will not stop an active malware infection or its potential spread; isolation is more immediate.
Malware Containment
The first critical step in a malware removal process, which involves isolating the infected system from the network to prevent the malware from spreading to other systems, accessing external resources, or exfiltrating data.
- Prevents malware spread
- Stops data exfiltration
- Facilitates safe analysis and removal
- Often involves disconnecting from wired and wireless networks
Memory trick: Isolate the patient before you try to cure them, or they'll infect everyone!