220-1102 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Pay the ransom to retrieve the files.

  Why it's wrong here

  Paying the ransom is ineffective from a security standpoint because cybercriminals often fail to provide working decryption tools even after payment, and there is no legal or technical guarantee of data recovery. Additionally, sending money funds criminal infrastructure and directly encourages the continued development of ransomware, potentially making you a repeat target. Law enforcement agencies, including the FBI, explicitly advise against paying as it does not remediate the underlying vulnerability that allowed the infection.

• ✗

  Reimage the computer immediately.

  Why it's wrong here

  Reimaging the computer immediately destroys all volatile and non-volatile evidence, such as the ransomware binary, runtime artifacts in memory (if the machine is still on), and valuable log entries that could reveal the initial attack vector. This action also bypasses the critical requirement to contain the threat on the network; if the malware has already spread to other systems or shares, reimaging only this device leaves the broader outbreak unresolved. The correct order is to isolate the system first, then preserve forensic evidence, and only after containment is confirmed can you rebuild the image.

• ✓

  Disconnect the computer from the network.

  Why this is correct

  Disconnecting the computer from the network is the proper first response because it creates an immediate hard boundary that stops the ransomware from contacting its command-and-control server and prevents it from scanning or encrypting network-attached drives. This action also halts any active lateral movement by the attacker into other hosts on the same local network, which is a primary objective of ransomware containment. Physically unplugging the Ethernet cable or disabling the wireless adapter is the most direct way to achieve this isolation without relying on software that may already be compromised.

• ✗

  Run a full antivirus scan.

  Why it's wrong here

  Running a full antivirus scan on an actively infected and network-connected system is insufficient as a first response because the scanner is running under a compromised kernel and its findings cannot be trusted; the ransomware may also detect on-access scanning and encrypt additional files as the scanner opens them for inspection. More importantly, the scan does nothing to prevent the ransomware from communicating with its C2 server or spreading to adjacent systems, so the threat continues to propagate while the scan consumes resources. Containment by disconnection must precede any remediation attempt, including antivirus scanning, and the scan should later be performed from a clean, controlled environment or using a rescue image.

Go deeper

Related to this question