PC Security Issue Remediation practice questions

Pay the ransom to get the decryption key

Why wrong: Paying does not guarantee decryption and supports criminal activity; it is not recommended.

Reboot into Safe Mode and run a malware scan

Why wrong: While scanning may remove the ransomware, it will not decrypt already-encrypted files; backup restoration is needed.

Run System Restore to a point before the attack

Why wrong: System Restore may not recover encrypted user files and could be ineffective if the ransomware has disabled it.

Disable the USB blocking Group Policy for the entire domain

Why wrong: Disabling the policy for the whole domain exposes all workstations to risk, not just the manager's.

Give the manager a company-approved USB drive and tell them to use it only once

Why wrong: Without changing the block policy, the drive will still be blocked; instructions alone do not remediate the technical restriction.

Create a local admin account on the manager's workstation and disable the USB block locally

Why wrong: Local changes can be overridden by Group Policy and create a security gap; it is better to manage via policy.

Set a strong BIOS password

Why wrong: A BIOS password prevents booting but the drive can still be removed and read in another machine.

Install an antivirus with anti-theft features

Why wrong: Antivirus software does not encrypt the drive; it may have tracking features but does not protect data if the drive is removed.

Use a cloud backup service

Why wrong: Cloud backup ensures data recovery but does not prevent access to data on the stolen drive.

Check the power plan settings for sleep timeout

Why wrong: Sleep timeout turns off the display but does not lock the workstation; it may not meet the policy requirement.

Ensure Windows Update is fully installed

Why wrong: Updates do not affect screen lock behavior; the issue is configuration-related.

Disable the Fast Startup feature

Why wrong: Fast Startup affects boot times, not inactivity locking.

Disable the user accounts and require a manager to re-enable them

Why wrong: This is overly disruptive and does not address the root cause of weak password practices.

Send a company-wide email reminding users to choose strong passwords

Why wrong: Education is helpful but not enforceable; users may continue using weak passwords without technical controls.

Install a third-party password manager for all employees

Why wrong: Password managers help but do not enforce password strength on the domain accounts themselves.

Windows Defender Firewall

Why wrong: Firewall protects network traffic but does not encrypt stored data.

User Account Control (UAC)

Why wrong: UAC prevents unauthorized system changes but does not protect data if the drive is removed.

Windows Hello for Business

Why wrong: Windows Hello provides biometric authentication but does not encrypt the drive.

The antivirus subscription has expired; renew it

Why wrong: While possible, the question states no prompts were seen; a disabled update service is a common cause that also explains the lack of prompts.

The user has manually set the antivirus to manual update mode

Why wrong: Manual mode would still show prompts or notifications; the lack of any prompts points to a service-level issue.

The computer is infected with a virus that blocks updates

Why wrong: Infection could block updates, but the technician found no other symptoms; the update service being disabled is a simpler and more common cause.

Run a full antivirus scan

Why wrong: While important, scanning should be done after disconnecting from the network to avoid reinfection or data theft during the scan.

Reboot the computer in Safe Mode

Why wrong: Safe Mode can help with removal but should be done after isolation; it is not the very first action.

Restore from a recent backup

Why wrong: Restoring from backup should only be considered after confirming the backup is clean and the system is isolated; it is not the first step.

Run a system restore to a previous restore point

Why wrong: System Restore may not remove all components, and the virus could persist in restore points or system files.

Disable System Restore and then run an antivirus scan in normal mode

Why wrong: While disabling System Restore helps, scanning in normal mode may still allow the virus to hide or reinfect.

Reinstall Windows from the recovery partition

Why wrong: Reinstalling is a last resort; booting from rescue media is less disruptive and often effective.

Reinstall the operating system

Why wrong: Reinstalling is excessive; the issue is limited to browser settings that can be easily reset.

Run a disk cleanup utility

Why wrong: Disk cleanup removes temporary files but does not fix browser configuration changes.

Update the antivirus definitions and scan again

Why wrong: The adware is already removed; scanning again will not revert browser settings.

Windows Defender Antivirus settings

Why wrong: Windows Defender Antivirus handles malware detection, not firewall rules.

Group Policy Editor

Why wrong: Group Policy can deploy firewall rules across a domain, but on a local workstation, the technician would use the Windows Defender Firewall with Advanced Security console directly.

Network and Sharing Center

Why wrong: Network and Sharing Center provides basic firewall status and network profile settings, but not the detailed rule creation needed for specific application allowances.

Run a full antivirus scan in normal mode.

Why wrong: Fileless malware often evades traditional signature-based scans because it does not write files to disk; scanning in normal mode may miss it.

Use the Windows Malicious Software Removal Tool (MSRT) in Safe Mode.

Why wrong: MSRT is a basic tool that may not detect advanced fileless threats; it also runs within Windows, where the malware can hide.

Restore the system from a backup taken before the infection.

Why wrong: Restoring from backup may reintroduce the malware if the backup is infected, and it does not address the root cause of the infection.

Reinstall the operating system from scratch.

Why wrong: While a clean install ensures removal, it is a last resort; the technician should first attempt to repair system files and check for remaining issues.

Disable System Restore and delete all restore points.

Why wrong: This is a good practice to remove any infected restore points, but it does not fix current file corruption or instability.

Perform a disk cleanup to remove temporary files.

Why wrong: Disk cleanup frees up space but does not repair system files damaged by malware.

Run a full antivirus scan on the affected workstation.

Why wrong: Running a scan without isolating the system first could allow the ransomware to continue encrypting files and communicating with its command server.

Back up all files to an external drive before taking action.

Why wrong: Backing up during an active ransomware infection could result in backing up encrypted files, and the ransomware may also infect the external drive.

Restart the computer and boot into Safe Mode.

Why wrong: While Safe Mode is useful later, the first step must be to disconnect from the network to prevent further spread.

EFS (Encrypting File System)

Why wrong: EFS encrypts individual files and folders on NTFS volumes, but it is not designed for whole-drive encryption of removable media.

Windows Defender Firewall

Why wrong: Windows Defender Firewall controls network traffic, not drive encryption.

Device Manager

Why wrong: Device Manager is used to manage hardware drivers and devices, not to enable encryption.

Reset the account password and enable MFA.

Why wrong: While these are important, the first step must be to disable the account to stop ongoing unauthorized access immediately.

Review the server logs to determine the extent of the breach.

Why wrong: Log review is important for investigation, but containment (disabling the account) should come first to prevent further damage.

Notify the employee's manager and HR department.

Why wrong: Notification is part of the incident response process, but the immediate technical step is to disable the compromised account.

Set the power plan to turn off the display after 5 minutes.

Why wrong: Turning off the display does not lock the workstation; the user can wake it without authentication unless a password on wake is also set in power options.

Enable the 'Require password on wakeup' setting in the power plan only.

Why wrong: This requires a password when waking from sleep, but it does not automatically lock the workstation after 5 minutes of inactivity if the screen saver is not set.

Set the computer to sleep after 5 minutes and require a password on wake.

Why wrong: Sleep mode may take longer to resume and could interfere with background tasks; the policy specifies screen lock, not sleep.

EFS (Encrypting File System)

Why wrong: EFS encrypts individual files and folders, not the entire drive, and is not as robust against physical theft as full-disk encryption.

Windows Defender Antivirus

Why wrong: Windows Defender is an antivirus program, not an encryption tool.

TPM (Trusted Platform Module)

Why wrong: TPM is a hardware security chip that can support BitLocker, but it is not an encryption tool itself; it stores encryption keys securely.

Run a full antivirus scan while the system is connected to the internet.

Why wrong: Running a scan while connected may allow malware to communicate with its source, potentially downloading more payloads or evading detection.

Perform a System Restore to a point before the pop-ups started.

Why wrong: System Restore may not remove all malware, especially if it has infected system restore points or persists in user data.

Immediately reinstall Windows 10 to ensure complete removal.

Why wrong: Reinstalling is a last resort after less drastic remediation steps have failed or if the infection is severe; it is not the first step.

The antivirus definitions are outdated.

Why wrong: Outdated definitions could miss the virus, but the technician already removed it in Safe Mode, so the issue is likely persistence, not detection.

The user is re-downloading the virus from the same source.

Why wrong: While possible, the scenario states the virus 'keeps reappearing after removal' without user action, pointing to a persistence mechanism rather than user behavior.

The virus is a polymorphic variant that changes its signature.

Why wrong: Polymorphic malware changes code to avoid signature detection, but the technician successfully removed it in Safe Mode, so the issue is not evasion but re-infection.