easyMultiple ChoiceObjective-mapped
220-1102 Practice Question: A user calls the help desk saying they cannot log…
A user calls the help desk saying they cannot log into their Windows 10 workstation because a message claims their files are encrypted and they must pay a ransom. What is the most effective remediation approach?
⚠ Common exam trap
CompTIA often tests the misconception that removing the malware (via Safe Mode or System Restore) will undo the encryption, when in fact encryption is a cryptographic operation that persists after the malware is gone.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disconnect from the network and restore files from a verified backup
Ransomware encrypts files with a key known only to the attacker, making decryption without the key impossible. Disconnecting from the network prevents the ransomware from spreading to other systems, and restoring from a verified backup is the only reliable way to recover the original files without paying the ransom.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Pay the ransom to get the decryption key
Why it's wrong here
Paying the ransom is strongly discouraged because there is no guarantee that the attackers will provide a functional decryption key, leaving the data still encrypted and the payment lost. Furthermore, capitulating to ransomware demands incentivizes and funds criminal organizations, perpetuating future attacks against other victims. This approach also fails to address the underlying security vulnerabilities that allowed the infection.
- ✗
Reboot into Safe Mode and run a malware scan
Why it's wrong here
Rebooting into Safe Mode and running a malware scan might successfully remove the active ransomware executable, preventing further encryption from occurring. However, this action does not reverse the encryption applied to files before the ransomware's removal. The data remains inaccessible and corrupted, necessitating a different recovery strategy for the already-encrypted files.
- ✓
Disconnect from the network and restore files from a verified backup
Why this is correct
Disconnecting the infected system from the network immediately isolates the threat, preventing the ransomware from spreading to other network resources or communicating with command-and-control servers. Subsequently, restoring files from a verified, clean backup is the most effective and recommended method to recover encrypted data without paying the ransom. This process ensures data integrity and system functionality, adhering to best practices for ransomware incident response.
- ✗
Run System Restore to a point before the attack
Why it's wrong here
Running System Restore primarily reverts system files, installed applications, and registry settings to a previous state, but it typically does not restore user-created data files. Therefore, encrypted personal documents, photos, and other critical user files would likely remain encrypted even after a successful System Restore operation. Moreover, advanced ransomware variants often disable or corrupt System Restore points to prevent this recovery method.
Go deeper
Related to this question
Learn chapter
Windows Editions and Features
Key term
Windows
Windows is a family of operating systems developed by Microsoft that manages computer hardware and software, providing a graphical user interface for users to interact with their devices.
Key term
Backup
A backup is a copy of computer data taken and stored separately so that the original data can be restored if it is lost, damaged, or corrupted.
About these practice questions
Courseiva writes every 220-1202 question from scratch — 495 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 220-1202
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A user calls the help desk saying their PC suddenly displays a ransom note demanding payment in Bitcoin to unlock their files. They cannot open any documents or images. What is the first action you should take?
easy- A.Pay the ransom to get the decryption key.
- B.Run a full antivirus scan immediately.
- ✓ C.Disconnect the PC from the network.
- D.Restore files from a recent backup without disconnecting.
Why C: The correct first action is to disconnect the PC from the network (Option C). This immediately isolates the infected system, preventing the ransomware from communicating with its command-and-control (C2) server to exfiltrate data or encrypt additional network shares. It also stops the ransomware from spreading laterally to other devices on the same LAN, which is critical for containment before any remediation steps are taken.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.