A technician is responding to a security incident where malware has been detected on several workstations. According to industry best practices (such as NIST or SANS), which step should the technician perform FIRST after confirming the incident?

Identify the root cause and scope of the incident

Identification and analysis are important, but they occur after immediate containment to prevent further harm. Containment is the first priority to stop the spread.

Eradicate the malware from all affected systems

Eradication (removing malware) comes after containment. If you try to eradicate before containing, the malware may continue to spread.

Document all findings in the incident report

Documentation is ongoing, but the first action after confirmation is containment to prevent escalation. Proper documentation will follow.

What does this 220-1101 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Contain the incident to prevent further spread — After detection and confirmation of a security incident, the first step in the incident response process is containment. This prevents the malware from spreading to other systems and limits damage. Containment includes isolating affected workstations from the network, disabling user accounts, and blocking malicious IPs. Identification/verification occurs before this, but once confirmed, containment is the priority.

What should I do if I get this 220-1101 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.