A small business experiences a ransomware attack that encrypted all files on a single workstation. The technician isolates the workstation, removes the malware using a bootable antivirus scanner, and restores the encrypted files from a verified cloud backup. According to best practices for incident response, which step should the technician perform NEXT?

Reimage the workstation to ensure all malware traces are removed

The technician has already used a bootable scanner to remove malware and restored files from backup. Reimaging is typically done if the system cannot be cleaned thoroughly or if data restoration is not possible. Here, the system is already cleaned and functional, so reimaging is an extra step that may not be needed.

Notify local law enforcement about the ransomware attack

While law enforcement may be notified in some cases, especially if sensitive data is involved, it is not an immediate requirement for every incident. The priority after recovery is to wrap up the incident internally before deciding on external notifications.

Disable the user's account to prevent further access

The user account was likely compromised, but the incident has been contained. Unless there is evidence of ongoing unauthorized access or malicious intent by the user, disabling the account is not necessary. The focus should be on restoring normal operations and learning from the incident.

What does this 220-1101 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Document the incident and review lessons learned — After containment, eradication, and recovery, the next step in the incident response process is post-incident activity. This includes documenting the incident, analyzing what went wrong, and implementing lessons learned to prevent future occurrences. Notifying law enforcement is not always required and is not the immediate next step. Reimaging the workstation is unnecessary since data was restored from backup. Disabling the user's account is not warranted unless the user was involved in the breach.

What should I do if I get this 220-1101 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.