ITPEC IP April 2025 Question 41
ITPEC IP April 2025 — Question 41 of 100
Disconnect the PC from networks immediately — containment reduces the chance that malware spreads or communicates externally.
Removing wired and wireless network connectivity isolates the suspected machine while preserving its current state for investigation. The user should then report the incident through an approved channel from another device and follow the organization's response procedure.
Answer (c)
Why not others:
- (a) rebooting can alter evidence and does not contain network propagation first
- (b) sending e-mail from the infected PC keeps it connected and may spread malicious content
- (d) backing up after detection can copy infected files or contaminate backup media
Key rule: On suspected infection, contain first, report through a safe channel, preserve evidence, and let authorized responders eradicate and recover.
AI-generated — may contain errors
The original exam layout is preserved in the image so diagrams, formulas, tables, and code remain accurate.
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official IP past-paper collection or Report an issue.