easyMultiple Choice
ISC2 CC Practice Question: A help desk technician receives a report that a…
A help desk technician receives a report that a user cannot access a shared network drive. The technician checks the file server and sees that the disk is full. What is the most immediate action the technician should take?
⚠ Common exam trap
The trap here is choosing a dramatic action like rebooting or running antivirus when the scenario clearly identifies a specific root cause (disk full) that has a direct, simple remediation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Free up space by deleting unnecessary files or moving data
A full disk on the file server is the direct cause of the user's inability to access the shared drive, so the most immediate remediation is to reclaim space by deleting unnecessary files or relocating data. This restores write capability and resolves the symptom without unnecessary disruption. It is the fastest, least invasive action that addresses the root cause identified during triage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reboot the file server
Why it's wrong here
Rebooting does not free disk space and interrupts the service other users still depend on, leaving the full volume unchanged. It is tempting as a generic first-line fix, but it would be correct only for a hung service or memory fault, not exhausted storage.
- ✓
Free up space by deleting unnecessary files or moving data
Why this is correct
Freeing space directly resolves the full disk, the constraint blocking the share. Deleting unnecessary files or relocating data restores write capacity so the server can serve the network drive again. This is the fastest remediation, taking precedence over permission checks or reboots, which would not address the exhausted storage.
- ✗
Run antivirus scan
Why it's wrong here
An antivirus scan addresses malware, not capacity, and cannot restore write access while the volume remains full. It is tempting because a full disk can indicate malicious file creation, but scanning is the correct step only once a compromise is actually suspected.
- ✗
Increase disk quota
Why it's wrong here
Raising a quota limits per-user consumption; it cannot free space on a volume already at 100%, so the share stays inaccessible. Quotas are the right tool when one user's consumption must be capped, not when the underlying disk itself is exhausted.
Visual reference
Go deeper
Related to this question
Learn chapter
Network Security Components and Controls
Key term
Triage
Triage is the process of quickly assessing and prioritizing security incidents based on their severity, impact, and urgency to determine the appropriate response.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
One of 989 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.