220-1102 Question 413
Single answerStalkerwareA user brings in an Android phone and says their ex-partner seems to know their location, messages, and recent calls even after passwords were changed. The user also says the ex-partner had physical access to the phone for several hours last week. As the technician, you suspect stalkerware. What should you do FIRST to best protect the user's safety and preserve evidence for possible legal action?
- A
Factory reset the phone immediately so the monitoring stops as quickly as possible
- B
Document the symptoms, advise the user not to confront the suspected abuser, and help them contact appropriate support before making major changes to the device
- C
Install a mobile antivirus app and remove any suspicious apps right away
- D
Change all of the user's account passwords again from the suspected phone
Show answer and explanation
Correct answer: B
Explanation
Stalkerware is a form of spyware used to monitor a victim's location, communications, or activity, often in domestic abuse situations. In an A+ Core 2 context, the correct response is not simply technical removal. The technician should prioritize the user's safety, document what is happening, avoid tipping off the suspected abuser, and recommend appropriate support resources before making major device changes. This aligns with general security best practices around incident handling and with guidance from organizations such as the Coalition Against Stalkerware, which emphasizes safety planning, evidence preservation, and avoiding actions that could escalate risk. Technical steps like scanning, removing apps, changing passwords, or resetting the device may be appropriate later, but not before addressing immediate safety concerns.
- A. Incorrect.
This is incorrect. A factory reset may remove the stalkerware, but doing it immediately can destroy evidence that may be useful in a legal, workplace, or personal safety situation. Best practice with suspected stalking or intimate partner abuse is to consider the user's immediate safety first and avoid abrupt changes that could alert the abuser before the user has a plan.
- B. Correct.
This is correct. With suspected stalkerware, the first priority is user safety. Documenting symptoms and advising the user not to confront the suspected abuser can reduce risk, since confrontation or sudden device changes may escalate the situation. Helping the user connect with appropriate support resources before taking action is consistent with safety-focused guidance for spyware and domestic abuse situations.
- C. Incorrect.
This is incorrect. Although anti-malware tools can help identify potentially unwanted monitoring software, removing apps immediately is not the best first step in a suspected stalkerware case. Removal can alert the person who installed it, and it may erase evidence. A technician should first consider documentation, safety planning, and escalation to appropriate support.
- D. Incorrect.
This is incorrect. Changing passwords from the suspected device is not the best first action because the device itself may be compromised. In addition, the user's ex-partner may still receive alerts or otherwise notice account changes, which can create a safety issue. If password changes are needed, they are safer from a known-good device after a plan is in place.