mediumMultiple ChoiceObjective-mapped
220-1202 Practice Question: That their computer is running slowly after they…
A user reports that their computer is running slowly after they installed a 'free system cleaner' from a pop-up ad. The technician suspects malware. What is the most appropriate first step in handling this situation professionally?
⚠ Common exam trap
CompTIA often tests the distinction between technical urgency and professional communication, where candidates mistakenly choose a technically correct action (like running a scan) over the professionally required first step of gathering information without blame.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ask the user to describe exactly what they installed and from where, without sounding accusatory.
The first step in handling a potential malware infection professionally is to gather information from the user without judgment. Asking the user to describe what they installed and from where helps the technician understand the attack vector (e.g., a fake pop-up ad), which is critical for selecting the appropriate remediation steps and for any future security awareness training. This approach maintains trust and encourages the user to report issues promptly, which is essential for effective incident response.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Immediately run a full antivirus scan and quarantine any threats found.
Why it's wrong here
Immediately running a full antivirus scan, while a valid troubleshooting step for potential malware, is not the initial best practice when a user reports general system slowness, especially if recent software installations are suspected. This approach bypasses crucial information gathering regarding recent changes and fails to obtain user consent before initiating potentially resource-intensive operations. A technician should first understand the context of the issue to narrow down potential causes effectively.
- ✓
Ask the user to describe exactly what they installed and from where, without sounding accusatory.
Why this is correct
Asking the user about recent installations is the most effective initial step because it directly addresses a common cause of system performance degradation: newly installed or conflicting software. This non-accusatory approach encourages the user to provide honest and detailed information, which is vital for accurate diagnosis and efficient troubleshooting. Gathering this specific context allows the technician to focus subsequent diagnostic efforts, rather than performing broad, undirected actions.
- ✗
Tell the user that installing software from pop-ups is dangerous and they should know better.
Why it's wrong here
Blaming the user for their actions, such as installing software from pop-ups, is unprofessional and counterproductive in a technical support role. This judgmental response can make the user defensive, erode trust, and discourage them from reporting future issues or providing accurate details about the problem. Effective troubleshooting relies on open communication and a supportive environment, not on shaming or lecturing the end-user.
- ✗
Remotely uninstall the program without informing the user.
Why it's wrong here
Remotely uninstalling a program without first informing the user is a significant breach of professional ethics and user trust. Such an action can lead to unexpected data loss, application dependencies breaking, or user frustration due to unapproved changes to their system. Proper IT protocol dictates that technicians must always communicate proposed actions and obtain explicit consent from the user before making modifications to their computer.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 220-1202 question from scratch — 495 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.