220-1102 Practice Question: That their Windows 11 computer is infected with…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Pay the ransom to get the decryption key.

  Why it's wrong here

  Paying the ransom directly funds criminal organizations, perpetuating ransomware attacks globally and encouraging future malicious activities. Furthermore, there is no guarantee that the decryption key provided will actually work or that the attackers will even deliver it after payment, often leaving victims with both lost data and financial loss. This approach is highly discouraged by cybersecurity experts and law enforcement due to its inherent risks and ethical implications.

• ✓

  Disconnect the computer from the network and restore files from the external backup.

  Why this is correct

  Immediately disconnecting the infected computer from the network is critical to prevent the ransomware from spreading to other systems or communicating with its command-and-control server for further instructions or key exfiltration. Once isolated, restoring files from a verified, uninfected external backup is the most reliable and secure method to recover data without succumbing to the ransom demand. This process ensures complete data integrity and system functionality restoration.

• ✗

  Run a full antivirus scan to remove the ransomware and then restore files.

  Why it's wrong here

  While running a full antivirus scan is essential for identifying and removing the ransomware executable from the system, it cannot reverse the encryption applied to user files by the malware. Antivirus software primarily focuses on threat eradication, not data decryption, meaning the files remain inaccessible even after the ransomware itself is gone. Therefore, a separate data recovery step, typically from a backup, is still necessary to restore the encrypted files to their original state.

• ✗

  Use System Restore to revert the system to a previous state.

  Why it's wrong here

  System Restore is designed to revert critical Windows system files, registry settings, and installed applications or drivers to a previous operational state, not to recover personal user data. Since ransomware specifically targets and encrypts user documents, photos, and other personal files, System Restore will not decrypt or restore these affected items. Consequently, while the operating system might be stabilized, the user's encrypted data would remain inaccessible.

Go deeper

Related to this question