easyMultiple ChoiceObjective-mapped
220-1202 Practice Question: A user calls the help desk saying their PC…
A user calls the help desk saying their PC suddenly displays a ransom note demanding payment in Bitcoin to unlock their files. They cannot open any documents or images. What is the first action you should take?
⚠ Common exam trap
CompTIA often tests the principle of 'containment before eradication' — the trap here is that candidates may jump to scanning (Option B) or backup restoration (Option D) without first isolating the system, which would allow the ransomware to continue spreading or re-encrypting files during those actions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disconnect the PC from the network.
The correct first action is to disconnect the PC from the network (Option C). This immediately isolates the infected system, preventing the ransomware from communicating with its command-and-control (C2) server to exfiltrate data or encrypt additional network shares. It also stops the ransomware from spreading laterally to other devices on the same LAN, which is critical for containment before any remediation steps are taken.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Pay the ransom to get the decryption key.
Why it's wrong here
Paying the ransom is strongly discouraged because it provides no guarantee that a working decryption key will be provided, leaving the user's files still encrypted. Furthermore, it financially supports criminal organizations, encouraging them to perpetuate future attacks against other victims. This action does not resolve the underlying security vulnerability that allowed the ransomware to infect the system.
- ✗
Run a full antivirus scan immediately.
Why it's wrong here
Running a full antivirus scan immediately, while the PC remains connected to the network, is premature and potentially dangerous. The primary concern is that the active ransomware could continue to encrypt network shares or spread laterally to other systems before the scan completes or identifies the threat. Isolation of the infected machine must be the first step to contain the damage and prevent further compromise.
- ✓
Disconnect the PC from the network.
Why this is correct
Disconnecting the PC from the network is the critical first step to contain a ransomware infection. This action immediately prevents the ransomware from encrypting shared network drives, cloud storage, or other network-accessible resources. It also severs communication with the attacker's command and control (C2) server, stopping further instructions or data exfiltration, thereby limiting the scope of damage to the infected machine itself.
- ✗
Restore files from a recent backup without disconnecting.
Why it's wrong here
Restoring files from a recent backup without first disconnecting the PC from the network is highly risky and ineffective. If the ransomware process is still active on the system and the network connection remains, any restored files, especially those on network shares or cloud drives, could be immediately re-encrypted. The active threat must be neutralized and contained before attempting any restoration to ensure the integrity of the recovered data.
Go deeper
Related to this question
About these practice questions
One of 495 original 220-1202 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.