When a system administrator discovers a user's PC running slowly with 100% CPU utilization, it often indicates that the system is being used for unauthorized purposes, such as being part of a botnet attack. Here's why:
* Botnet attack: Botnets are networks of computers infected with malware and controlled by an attacker.
These infected computers (bots) are often used to carry out tasks like sending spam or participating in Distributed Denial of Service (DDoS) attacks. The high CPU utilization and resource usage indicate that the computer might be performing tasks dictated by the botnet controller.
* Firewall activities: While firewall activities can use some resources, they generally do not cause sustained high CPU utilization.
* DDoS attack: DDoS attacks target external systems by overwhelming them with traffic. A system participating in a DDoS might have high network usage, but the primary symptom on the user's PC would be high network activity, not necessarily CPU usage.
* Keylogger attack: Keyloggers record keystrokes and generally do not cause high CPU utilization. They are more stealthy and have minimal resource footprints.
Reference:
CompTIA A+ 220-1102 Exam Objectives, Section 2.4: Explain common social-engineering attacks, threats, and vulnerabilities.
Security and malware documentation.

Malware is malicious software that can cause damage or harm to a computer system or network4. A technician has verified a computer is infected with malware by observing unusual behavior, such as slow performance, pop-ups, or unwanted ads. The technician isolates the system and updates the anti-malware software to prevent further infection or spread of the malware. The next step is to run repeated remediation scans until the malware is removed. A remediation scan is a scan that detects and removes malware from the system. Running one scan may not be enough to remove all traces of malware, as some malware may hide or regenerate itself.

A virtual private network (VPN) is a technology that creates a secure and encrypted connection over a public network, such as the internet. A VPN allows remote employees to access the corporate intranet as if they were physically connected to the local network3. Password-protected Wi-Fi is a security measure for wireless networks that does not provide access to the corporate intranet. Port forwarding is a technique that allows external devices to access services on a private network through a router, but does not provide access to the corporate intranet. A perimeter network is a network segment that lies between an internal network and an external network, such as the internet, and provides an additional layer of security, but does not provide access to the corporate intranet.

When a smartphone is lost, especially one that might contain sensitive or private data, the primary concern is to ensure that any data on the device cannot be accessed by unauthorized persons. Among the options provided:
* Remote lock: This option will lock the device remotely, preventing access. However, it does not remove the data and might not be effective if the device is powered off or reset.
* Remote wipe: This is the best option as it allows the technician to erase all data from the device remotely, ensuring that sensitive information is not accessible to anyone who finds or steals the device.
* Remote access: This option would allow a technician to access the device remotely, but it would not directly prevent unauthorized access or data breaches.
* Remote encrypt: Encrypting the device remotely might not be possible if the device is not accessible or turned on, and it does not remove existing data which could be at risk.
Reference: CompTIA A+ Exam Objectives [220-1102] - 3.4: Given a scenario, use best practices to secure a mobile device.

When dealing with a suspected virus infection on an air-gapped computer, after an initial scan with Windows Defender shows no infection, the next steps should include examining the event logs to look for suspicious activity and updating the virus definitions for a more thorough scan. Event logs can provide insights into system changes and potential malicious activities, while updated definitions ensure the antivirus software can detect the latest threats. Connecting to the network or enabling the firewall might not be appropriate due to the risk of spreading the infection, and re-imaging the computer or documenting the findings would be subsequent steps if the initial actions don't resolve the issue.References: Official CompTIA A+ Core 1 and Core 2 Student Guide.