220-1102 Operational Procedures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Reboot the workstation in Safe Mode

  Why it's wrong here

  Rebooting a system suspected of ransomware in Safe Mode is dangerous because modern ransomware often installs persistence mechanisms that execute during the boot cycle, even in a reduced driver environment. Many variants actively check for Safe Mode and will trigger encryption or delete-shadow-copy routines upon startup, while memory-resident payloads might detonate only after a reboot. The correct first step is to isolate the machine by cutting physical network connectivity, not to alter the system state and run the risk of accelerating the attack.

• ✓

  Disconnect the network cable from the workstation

  Why this is correct

  Disconnecting the network cable is the immediate priority because it physically removes the workstation from both the local LAN and the internet, halting any active communication with command-and-control servers and preventing the ransomware from discovering and encrypting shared drives or spreading to adjacent hosts. This containment step does not rely on the OS, so the malware cannot intercept or spoof a software-based 'disconnect' command, and it simultaneously preserves volatile evidence such as running processes and memory while you prepare a more detailed forensic response.

• ✗

  Run a full antivirus scan

  Why it's wrong here

  Running a full antivirus scan on a live, network-connected workstation during an ongoing ransomware event can be counterproductive because the scan reads thousands of files, which may inadvertently trigger the malware's encryption routine or cause it to replicate further across the network. Malicious executables may also be designed to evade or disable scan engines, and waiting for a scan to finish gives the ransomware more time to complete its payload and exfiltrate data. The correct sequence is to first contain the threat by isolating the system, then scan or reimage as part of the eradication phase, not before.

• ✗

  Document the incident and report it to management

  Why it's wrong here

  Documenting the incident and reporting it to management before taking any technical action violates incident-response best practice because it delays containment while a live ransomware outbreak is actively spreading. Every minute of delay increases the chance that the encryption engine reaches more files, user shares, or backup locations, and the immediate action should be to preserve network integrity by disconnecting the machine. Once the system is isolated and the immediate threat is paused, the technician can then gather accurate details, document the timeline, and escalate to management for formal incident handling and compliance purposes.

Go deeper

Related to this question