CompTIA Network+ (N10-009) — Question 218

A user called the help desk after business hours to complain that files on a device are inaccessible and the wallpaper was changed. The network administrator thinks that this issue is an isolated incident, but the security analyst thinks the issue might be a ransomware attack. Which of the following troubleshooting steps should be taken first?

Answer options

• A. Identify the problem.
• B. Establish a theory.
• C. Document findings.
• D. Create a plan of action.

Correct answer: A

Explanation

The initial step in troubleshooting is to identify the problem clearly to understand the scope of the issue. Establishing a theory, documenting findings, and creating a plan of action are subsequent steps that rely on having a clear understanding of the problem at hand.