Exam CS0-003 topic 1 question 409 discussion

Given the symptoms—slower performance and unexpected windows opening and closing—this could indicate malware (such as a virus or adware) running on the computer. Restarting the computer did not resolve the issue, which suggests that the problem persists and is likely being caused by malicious software.

The answer is B. Since the computer is showing signs of malware infection (slow performance, unexpected windows opening and closing), the priority is to prevent further damage and contain the threat. Disconnecting from the network stops potential data exfiltration and prevents lateral movement across the enterprise. Leaving the PC turned on helps preserve forensic evidence for investigation.

I am going with B because restarting could delete all forensic evidences or allow the possible malware to change its behavior (A), a legal hold i sonly needed for legal cases and CompTIA didn't mention it (C), and (D) should only be done after investigation and containment.