CompTIA A+ Certification Exam: Core 2 (#13)

A technician receives a phone call regarding ransomware that has been detected on a PC in a remote office. Which of the following steps should the technician take FIRST?

Disconnect the PC from the network
Perform an antivirus scan
Run a backup and restore
Educate the end user