220-1102 Operational Procedures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Reinstall the operating system on the workstation

  Why it's wrong here

  Reinstallation wipes the entire disk, destroying the very filesystem artifacts, MFT records, and unallocated-space remnants needed to trace how the malware first entered. It is a recovery step that must wait until root cause analysis identifies the infection vector, such as an unpatched service or malicious email attachment, because reinstalling without addressing that vector guarantees reinfection. Additionally, any network persistence like scheduled tasks on other hosts or C2 beaconing configurations would be missed, leaving lateral movement paths operational.

• ✗

  Scan the workstation with an antivirus tool

  Why it's wrong here

  Running an antivirus scan on the original workstation alters live forensic evidence: it updates file access times, writes quarantine logs, and can trigger the malware to execute further, potentially encrypting or deleting data. Because the technician already captured a forensic image, the proper next step is to analyze that image in a read-only, sandboxed environment using static and dynamic analysis techniques. This preserves the original as evidence and prevents contamination that could make legal or investigative findings unreliable.

• ✗

  Document the findings and report to management

  Why it's wrong here

  Although documentation is a continuous thread throughout the IR lifecycle, reporting to management at this stage is premature because the incident timeline and blast radius are still unknown. The next action after evidence collection is to analyze the forensic data to determine the entry point, scope of compromise, and indicators of compromise (IOCs). Only after root cause identification can the team provide accurate, meaningful status updates to management; premature reports risk conveying incorrect assumptions or unverified conclusions that could misguide executive decisions.

• ✓

  Identify the root cause of the infection

  Why this is correct

  After isolating the workstation and capturing a forensic image, the correct next step is analyzing that image alongside logs to determine the root cause—how the malware entered, what user actions or vulnerabilities enabled it, and which systems were affected. This root cause analysis directly informs eradication actions, such as removing specific payloads, patching a vulnerability, or revoking compromised credentials, ensuring that the threat is completely neutralized. Skipping this step leaves the organization vulnerable to the same attack path or hidden backdoors, making a clean reinstall worthless.

Go deeper

Related to this question