220-1102 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Pay the ransom to quickly regain access to files

  Why it's wrong here

  Paying the ransom is a high-risk action that provides no technical guarantee of decryption; attackers frequently take payment and withhold the decryption key. It also funds criminal infrastructure, may violate regulations or sanctions, and identifies the victim as willing to pay, which can make repeat attacks more likely. Security best practice directs organizations to treat payment as a last resort, considered only after exhausting all alternative recovery methods.

• ✓

  Disconnect the computer from the network

  Why this is correct

  Disconnecting the computer from the network is the correct first response because it physically severs the attacker's command-and-control channel and halts the ransomware's ability to encrypt mapped drives, network shares, or adjacent endpoints. This containment step also limits potential data exfiltration and preserves volatile evidence, such as active network connections in memory or the encryption routine's artifacts, for later forensic analysis. Immediate isolation is the foundational move in incident response before any scanning or recovery is attempted.

• ✗

  Run a full antivirus scan

  Why it's wrong here

  Running a full antivirus scan during an active ransomware infection can actually accelerate the damage: as the scan reads files, the already-resident ransomware may encrypt them in real time, and a zero-day variant may not match existing signatures, rendering the scan useless. Additionally, antivirus remediation tools that attempt to quarantine files while the malicious process is running can cause system instability, incomplete detection, or trigger the ransomware to engage in destructive self-deletion or mass encryption as a defensive measure. Proper sequence requires containment first, then an offline or forensically prepared scan.

• ✗

  Restore files from a recent backup

  Why it's wrong here

  Restoring files immediately from backup is premature because the network may still be compromised; if the ransomware or its persistence mechanism remains active, it will encrypt restored files again or re-infect the machine. A valid restore also depends on verifying that the backup set itself is clean and unencrypted, because many ransomware strains intentionally encrypt or delete local/online backups before escalating. Incident handling requires the technician to first contain the threat, identify the ransomware strain, and preserve forensic evidence, only then ensuring the chosen backup is clean and safe to restore.

Go deeper

Related to this question