Exam CS0-002 topic 1 question 224 discussion

In real life you would disconnect the workstation and issue the user with a new one. Then you would sanitize the workstation. However, this specifically mentions the eradication phase, not containment being the next step. So the answer would be C

Since the helpdesk technician already isolated the machine, the security analyst then comes in and performs his duties of eradication and recovery. Out of all the answers available, C is part of eradication and recovery.

Isolating the workstation and issuing a new computer to the user is not the NEXT step for the security analyst. While isolating the infected workstation and issuing a new computer to the user is a necessary step in the incident response process, it should not be done until the security analyst has fully understood the nature and extent of the threat posed by the malware.

why not B?

D. Isolate the workstation and issue a new computer to the user. Explanation: Isolating the infected workstation and issuing a new computer to the user is the most important step in preventing the malware from spreading further. By isolating the infected workstation, the security analyst can prevent the malware from spreading to other devices on the network, which is critical to maintaining the security of the organization.

C is correct.