If you are notified that your computer has a worm replicating across the network, what should you do first?

Disconnecting the network link is the most appropriate immediate action when a worm is identified replicating across the network. This step prevents the worm from spreading to other devices or systems while measures are being taken to address the infection. Worms are designed to propagate themselves over networks, and by disconnecting the affected computer from the network, you effectively contain the threat and limit its impact on the broader environment.

While running a virus scan, notifying the IT department, or updating antivirus software are all critical actions to take in response to a worm infection, they may not be as effective as immediately isolating the infected system. Running a virus scan can help identify threats, but if the system remains connected to the network, the worm could continue to spread. Notifying the IT department is essential for further action and troubleshooting, but it doesn't stop the worm from propagating in the interim. Similarly, updating antivirus software is important for protection, but again, if the system is still connected and the worm is actively spreading, it won’t mitigate the immediate threat. Therefore, the priority should be focused on containment by disconnecting from the network first.