ITPEC IP October 2025 Question 42

Immediately isolate the suspected PC from the network — containment is the first priority when signs indicate a possible malware infection.

Disconnecting the wireless LAN prevents the malware from spreading to other internal devices, sending data outside the organization, or receiving further commands. After isolation, the user should report the incident and follow the approved investigation and recovery procedure.

Answer (a)

Why not others: Reinstalling only the browser does not address malware elsewhere on the PC; updating malware definitions should be performed after containment under the response procedure; changing wireless encryption does not remove malware already running on an authorized device.

Key rule: In incident response, contain first, then investigate, eradicate, and recover. Do not leave a suspected infected device connected while attempting repairs.

AI-generated — may contain errors