Which of the following should the technician perform FIRST?

A user reports a workstation has been performing strangely after a suspicious email was opened on it earlier in the week.

Which of the following should the technician perform FIRST?
A . Escalate the ticket to Tier 2.
B . Run a virus scan.
C . Utilize a Windows restore point.
D . Reimage the computer.

Answer: B

Explanation:

https://partners.comptia.org/docs/default-source/resources/comptia-a-220-1102-exam-objectives-(3-0)

When a user reports that their workstation is behaving strangely after opening a suspicious email, the first step a technician should take is to run a virus scan on the computer. This is because opening a suspicious email is a common way for viruses and malware to infect a computer. Running a virus scan can help identify and remove any infections that may be causing the computer to behave strangely.