CompTIA A+ Core 2 (220-1002) — Question 125

A technician receives a phone call regarding ransomware that has been detected on a PC in a remote office.
Which of the following steps should the technician take FIRST?

Answer options

• A. Disconnect the PC from the network
• B. Perform an antivirus scan
• C. Run a backup and restore
• D. Educate the end user

Correct answer: A

Explanation

The correct first step is to disconnect the PC from the network to prevent the ransomware from spreading to other devices. Performing an antivirus scan, running a backup and restore, or educating the end user are important but should follow the immediate action of isolating the infected machine.