A technician is investigating a potential security incident. A user reports that they clicked a link in an email and entered their corporate credentials on a website that appeared to be the company's VPN portal. The technician confirms the website is malicious and the credentials have been compromised. According to the company's incident response plan, what should the technician do FIRST?

Run a full antivirus scan on the user's workstation

Scanning is important but should follow credential remediation; the attacker still has access via the stolen credentials.

Disconnect the workstation from the network

Disconnecting stops active network threats but does not address the fact that credentials are already compromised and may be used from elsewhere.

Document the incident in the ticketing system

Documentation is necessary but should not delay the immediate critical step of securing the compromised account.

What does this 220-1101 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Reset the user's password and revoke any active tokens — The most urgent priority after credential compromise is to prevent unauthorized access. Resetting the user's password and revoking any active session tokens or multi-factor authentication tokens will invalidate the stolen credentials. Running an antivirus scan or disconnecting the network may be appropriate later, but the immediate threat is the compromised credentials. Documentation is important but not the first action.

What should I do if I get this 220-1101 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.