220-1102 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Run a full antivirus scan on the workstation.

  Why it's wrong here

  Running a full antivirus scan is a detection-centric reaction that assumes the ransomware signature is already known, but active encryption processes are already in memory and will continue modifying files while the scanner reads the disk. This simultaneous I/O contention not only slows the scan but can also trigger the malware to accelerate its encryption routine, and the heavy filesystem access alters access timestamps and other metadata essential for forensic analysis. Containment by severing the network connection must occur before any scanning, because the scan cannot undo ongoing encryption and may give the ransomware additional time to spread via mapped drives.

• ✓

  Disconnect the network cable from the workstation.

  Why this is correct

  Disconnecting the network cable immediately removes the workstation from the Layer 2 broadcast domain, terminating all active SMB/CIFS sessions to corporate file shares and blocking outbound connections to command-and-control infrastructure. This isolation-first action halts lateral movement across the network and prevents the ransomware from exfiltrating data or receiving decryption instructions, while preserving the live state in RAM for later memory forensics. Unlike powering off, this leaves the local processes intact so investigators can capture the ransomware binary and encryption artifacts, making it the correct initial step in incident containment.

• ✗

  Power off the workstation immediately.

  Why it's wrong here

  Powering off preserves the encrypted state but may allow the ransomware to have completed encryption on the local drive. More importantly, the network connection would still be active if not disconnected, so disconnecting the cable is a better first step.

• ✗

  Take a screenshot of the ransom note for documentation.

  Why it's wrong here

  Taking a screenshot of the ransom note is a documentation task that belongs to the later evidence-preservation phase, after the threat has been contained and the system is safely isolated. While the network cable remains connected, each moment spent capturing the screen gives the ransomware additional time to encrypt network shares, delete Volume Shadow Copies, and spread to adjacent hosts. The ransom note's details, such as the cryptocurrency wallet address and contact email, can be recorded later from disk images or the encrypted system itself, so deferring this step does not lose critical information but does save the network from further damage.

Go deeper

Related to this question