easyMultiple ChoiceObjective-mapped
220-1202 Practice Question: A customer reports that their computer is running…
A customer reports that their computer is running slowly and they see pop-up ads even when no browser is open. They suspect malware. Which of the following should you perform first to remediate this issue?
⚠ Common exam trap
The trap here is that candidates often jump to running an antivirus scan (Option A) as the immediate action, but CompTIA emphasizes containment first to prevent further damage or data loss, especially when active C2 communication is suspected.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disconnect the computer from the network
Disconnecting the computer from the network is the first step because it immediately stops the malware from communicating with its command-and-control (C2) server, preventing further data exfiltration, additional payload downloads, or remote control. This containment step is critical before any remediation (like scanning or rebooting) to avoid the malware spreading or causing more damage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Run a full antivirus scan
Why it's wrong here
Running a full antivirus scan as the initial step is premature because, while the scan is in progress, an active malware infection could continue to communicate with command-and-control servers, exfiltrate data, or attempt to spread to other network devices. Disconnecting from the network first ensures containment, preventing further damage or data loss during the potentially lengthy scanning process. An active infection might also evade detection or interfere with the scanning process if not isolated.
- ✓
Disconnect the computer from the network
Why this is correct
Disconnecting the computer from the network is the critical first step in malware remediation because it immediately isolates the infected system. This action prevents the malware from communicating with external command-and-control servers, stops data exfiltration, and halts any attempts to spread laterally to other devices on the local network. Containment is paramount before attempting any diagnostic or removal procedures, creating a safe environment for subsequent steps.
- ✗
Reboot the computer in Safe Mode
Why it's wrong here
Rebooting into Safe Mode is a valuable step for malware removal, as it loads only essential system services and drivers, potentially disabling active malware components and making them easier to remove. However, it should not be the *first* action. Prioritizing network disconnection ensures that even in Safe Mode, the system cannot communicate with malicious entities or spread the infection, creating a truly isolated environment for effective remediation.
- ✗
Restore from a recent backup
Why it's wrong here
Restoring from a recent backup is a recovery option, not an initial containment or diagnostic step, and should only be considered after thorough investigation and isolation. If the computer remains connected to the network, the newly restored system could be immediately reinfected. Furthermore, there's a risk that the backup itself might be compromised or contain the infection, necessitating verification of its integrity before use; it is a last resort, not a first response.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 220-1202 question from scratch — 495 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.