CompTIA CASP+ Practice Test

What should a user do if they notice their workstation's mouse pointer moving and files opening automatically?

1. Restart the workstation

2. Run a virus scan

3. Contact the incident response team for direction

4. Check for software updates

The correct answer is: Contact the incident response team for direction

When a user observes their workstation's mouse pointer moving autonomously and files opening without any direct input, it is indicative of a potential security incident or a malware infection. The best course of action in this situation is to contact the incident response team for direction. This choice is correct because the incident response team is equipped to handle security incidents and can take immediate and appropriate measures to investigate the issue, contain any potential breach, and mitigate risks to data integrity and security. Involving the incident response team ensures that the situation is handled according to company policy and best practices, which is vital in safeguarding the network and sensitive information. They can provide guidance on further actions such as isolating the workstation from the network, gathering logs for forensic analysis, and determining whether it’s a case of remote access by an unauthorized user or malware behavior. Other responses such as restarting the workstation or running a virus scan might provide temporary relief but will not address the underlying issue or prevent it from recurring. Checking for software updates may not be relevant to the immediate concern and could delay critical response actions that need to be taken. Thus, contacting the incident response team provides a proactive and systematic approach to an alarming situation.