A user calls the help desk reporting that their workstation is displaying a full-screen message claiming all files are encrypted and demanding a payment in Bitcoin to unlock them. According to incident response best practices, what should the technician do FIRST?

Reboot the workstation in Safe Mode

Rebooting could allow ransomware to continue encrypting files or trigger additional payloads. Isolation should come first.

Run a full antivirus scan

Scanning is important later, but the first step must be containment to prevent further damage.

Document the incident and report it to management

Documentation is necessary, but the technician must act first to limit the impact of the incident.

What does this 220-1101 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Disconnect the network cable from the workstation — The first priority in any malware incident, especially ransomware, is containment. Disconnecting the network cable isolates the workstation from the network, preventing the malware from spreading to other systems and potentially limiting data loss. Running antivirus, rebooting, or paying the ransom are premature or harmful actions before containment is achieved.

What should I do if I get this 220-1101 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.