Exam CS0-003 topic 1 question 409 discussion

The correct answer is: B. Disconnect from the network and leave the PC turned on. Explanation: • B. Disconnect from the network and leave the PC turned on – This action is part of the containment phase of incident response. It prevents potential spread of malware or data exfiltration while preserving the system’s current state for forensic analysis.

Given the symptoms—slower performance and unexpected windows opening and closing—this could indicate malware (such as a virus or adware) running on the computer. Restarting the computer did not resolve the issue, which suggests that the problem persists and is likely being caused by malicious software.

The answer is B. Since the computer is showing signs of malware infection (slow performance, unexpected windows opening and closing), the priority is to prevent further damage and contain the threat. Disconnecting from the network stops potential data exfiltration and prevents lateral movement across the enterprise. Leaving the PC turned on helps preserve forensic evidence for investigation.

I am going with B because restarting could delete all forensic evidences or allow the possible malware to change its behavior (A), a legal hold i sonly needed for legal cases and CompTIA didn't mention it (C), and (D) should only be done after investigation and containment.