A security analyst is reviewing logs after a malware infection on a user's workstation. The logs show that the malware attempted to contact multiple external IP addresses on port 445 (SMB) and also made several attempts to write to files with extensions like .docx, .xlsx, .pdf. The antivirus prevented the malware from executing but the analyst wants to contain the threat. According to incident response best practices, what should the analyst do FIRST?

Run a full antivirus scan

While a full scan may identify additional threats, containment should occur first to prevent the malware from spreading while the scan runs.

Change the user's password

Changing the password is important to prevent credential misuse, but it does not stop active network connections or potential lateral movement from the already infected machine.

Reimage the workstation

Reimaging is a final remediation step after containment, analysis, and evidence preservation. It should not be the first step.

What does this 220-1101 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Disconnect the workstation from the network — Incident response containment is the first priority after detection. The malware attempted to communicate over SMB (port 445) and write to files, indicating potential lateral movement or ransomware behavior. The immediate action is to disconnect the workstation from the network to prevent any further communication or spread. Running a full scan is useful but is a later step once containment is achieved. Changing the user's password helps protect credentials, but the most urgent step is to stop the threat from reaching other systems. Reimaging is a remediation step, not initial containment.

What should I do if I get this 220-1101 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.