A technician discovers that a user's workstation is infected with a Trojan that is logging keystrokes and capturing login credentials. The technician has already disconnected the computer from the network. According to standard incident response procedures, what should the technician do NEXT?

Report the incident to management immediately

Reporting is important, but it usually occurs after analysis so that a complete picture can be presented.

Create a forensic image of the hard drive

Creating a forensic image is an evidence preservation step that should be performed before or during containment, not after.

Reinstall the operating system

Reinstalling the OS is a remediation step that should only be taken after analysis to ensure proper removal and to prevent recurrence.

What does this 220-1102 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Analyze the scope and impact of the infection — After containing an incident (disconnecting from network), the next step in the incident response process is to analyze the scope and impact of the incident. This includes identifying what data may have been compromised, the extent of the infection, and how the Trojan gained entry. This information is crucial for determining the appropriate remediation steps and for reporting to management. While reporting to management is important, it typically follows the analysis. Creating a forensic image is part of evidence preservation, which should have been done before or during containment. Reinstalling the OS is a remediation step that occurs after analysis.

What should I do if I get this 220-1102 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.