ITPEC IP October 2018 Question 43
During the use of a PC in workplace, a message was displayed stating that antivirus software had detected a virus. Which of the following is an appropriate action that should be taken immediately on the PC?
Explanation
Disconnection of the PC from networks — isolating the infected PC first stops the virus from spreading to other computers and from sending data out.
A detected virus may already be trying to spread through shared folders, e-mail or the network itself. Unplugging the LAN cable or turning off Wi-Fi contains it at once. Then report to the administrator or security team by another means (telephone, another PC) and leave the PC as it is, so the infection can be investigated and removed properly.
Answer (c)
Why not others:
- •(a) — rebooting does not remove the virus; it may run again at start-up, the PC stays on the network, and traces needed for the investigation can be lost
- •(b) — sending e-mail from the infected PC keeps it on the network and can carry the virus to the recipients; report by another means
- •(d) — a backup taken now copies infected files and can spread the virus to the backup media or file server; backups are useful only when made before infection
Key rule: Contain first, then report: cut the infected machine off the network, tell the administrator through another channel, and leave the cleanup to the procedure.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official IP past-paper collection or Report an issue.