220-1102 Practice Question: During a security incident, a user's files have…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Pay the ransom to regain access quickly.

  Why it's wrong here

  Paying the ransom is generally discouraged by cybersecurity experts and law enforcement for several critical reasons. There is no guarantee that the attackers will provide a working decryption key, and even if they do, the decryption process can be complex, incomplete, or introduce further vulnerabilities. Furthermore, paying directly funds criminal enterprises, encouraging more attacks and validating their illicit business model, which ultimately makes other potential victims more vulnerable.

• ✓

  Disconnect the computer from the network immediately.

  Why this is correct

  Disconnecting the computer from the network immediately is the most critical first step in containing a ransomware infection. This action prevents the malware from encrypting additional local files, stops it from accessing and encrypting shared network drives or cloud storage, and halts its potential spread to other systems or network segments. Isolating the compromised machine effectively limits the scope of the attack and preserves uninfected data, which is crucial for incident response.

• ✗

  Run a full antivirus scan to remove the malware.

  Why it's wrong here

  While running a full antivirus scan is a necessary step for malware eradication, it does not address the immediate problem of already encrypted files. An antivirus program can detect and remove the ransomware executable, but it lacks the capability to reverse the cryptographic process that has rendered the user's data inaccessible. The primary concern in this scenario is data recovery, which an antivirus scan alone cannot achieve for data that has already been scrambled by encryption.

• ✗

  Restart the computer in Safe Mode and attempt file recovery.

  Why it's wrong here

  Restarting the computer in Safe Mode does not provide any inherent mechanism to decrypt files that have been locked by ransomware. Safe Mode is designed to troubleshoot system issues by loading a minimal set of drivers and services, which can be useful for removing persistent malware or resolving driver conflicts. However, it does not magically restore access to cryptographically scrambled data, as the encryption key remains with the attacker, making the files unreadable regardless of the operating mode.

Go deeper

Related to this question