220-1102 Security Practice Question
A small business owner calls a technician after discovering that all files on their Windows 10 workstation have been renamed with a '.crypt' extension. A ransom note demands payment in Bitcoin within 72 hours or the files will be permanently lost. The business has no recent backups. Which action should the technician take FIRST?
⚠ Common exam trap
The trap here is that candidates may prioritize recovery methods (like antivirus or Shadow Copies) over containment, failing to recognize that stopping the spread is the first step in any incident response plan.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disconnect the affected system from the network immediately.
The immediate priority in a ransomware incident is containment. Disconnecting the affected system from the network (Option C) prevents the ransomware from spreading laterally to other devices, encrypting additional files, or communicating with its command-and-control server. This step preserves the integrity of the rest of the network and gives the technician a safe environment to begin remediation without risking further data loss.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Advise the owner to pay the ransom to recover the files quickly.
Why it's wrong here
Paying the ransom is universally discouraged by law enforcement and cybersecurity agencies because it funds further criminal operations and offers no guarantee of file recovery. Attackers frequently accept payment and fail to deliver decryption keys, or they may deploy additional malware disguised as a decryptor. Moreover, an organization that pays becomes a known target for repeat attacks, and the payment may violate sanctions or regulations. The immediate priority should be isolating the infection, not negotiating with the attacker.
- ✗
Run a full antivirus scan on the affected system.
Why it's wrong here
Running a full antivirus scan is a detection and eradication step, not a containment step, and is inappropriate while the ransomware is actively encrypting or propagating. Modern ransomware variants are often polymorphic or zero-day, so signature-based antivirus may not even identify the threat, giving a false sense of security. Additionally, scanning an actively infected system can consume I/O resources and may trigger or accelerate encryption attempts as the scanner touches files. The correct sequence is to isolate the host first, then perform forensic analysis and scanning on a controlled, non-network-connected basis.
- ✓
Disconnect the affected system from the network immediately.
Why this is correct
Disconnecting the affected system from the network is the essential first step in incident response because it immediately halts propagation across SMB, mapped drives, and administrative shares. This action also cuts off the ransomware's command-and-control communication, preventing the attacker from issuing new instructions or exfiltrating data. Physically unplugging the network cable or disabling the wireless adapter is preferred over software-based disconnection, as a compromised system may ignore or spoof such commands. This containment step preserves evidence and minimizes the blast radius before any detection or recovery attempts.
- ✗
Attempt to restore files from Shadow Copies using Previous Versions.
Why it's wrong here
Attempting to restore from Shadow Copies using Previous Versions is often futile because ransomware specifically deletes the Volume Shadow Copies via commands such as vssadmin delete shadows, and it may also encrypt or corrupt the System Restore points. Even if shadow copies remain, trying to restore files while the ransomware is still active could result in re-encryption or the restoration of infected files. Recovery should only be attempted after the system is safely isolated and the ransomware binary has been identified and removed. In many cases, shadow copies are an unreliable recovery source for modern ransomware incidents.
Go deeper
Related to this question
Learn chapter
Data Sanitization: Wipe, Degauss, Shred, Incinerate
Key term
Ransomware
Ransomware is a type of malicious software that encrypts a victim's files or locks them out of their system, demanding payment, usually in cryptocurrency, to restore access.
Key term
Integrity
Integrity is the assurance that data has not been altered or tampered with in an unauthorized way, preserving its accuracy and consistency from source to destination.
About these practice questions
This 220-1102 question is part of Courseiva's 925-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1102 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1102 exam.