CompTIA A+ Core 2 (220-1102) — Question 492

A user clicked a link in an email, and now the cursor is moving around on its own. A technician notices that File Explorer is open and data is being copied from the local drive to an unknown cloud storage location. Which of the following should the technician do first?

Answer options

• A. Investigate the reported symptoms.
• B. Run anti-malware software.
• C. Educate the user about dangerous links.
• D. Quarantine the workstation.

Correct answer: D

Explanation

The correct first step is to quarantine the workstation to prevent any further data loss or unauthorized access while the situation is being assessed. Investigating symptoms or running anti-malware software should occur after ensuring the system is isolated to prevent potential malware from spreading. Educating the user is also important but is not a priority in this immediate situation.