easyMultiple ChoiceObjective-mapped
CAS-004 Practice Question: A small business has a single physical server…
A small business has a single physical server running multiple virtual machines (VMs) using Type 2 hypervisor software on a Windows Server host. The host is not joined to a domain. The VMs include an Active Directory domain controller, a file server, and a web server. The company recently suffered a ransomware attack that encrypted all data on the file server VM. The IT administrator restored the file server from a backup, but the ransomware returned within hours. Analysis shows that the ransomware is now spreading to other VMs. The administrator suspects that the hypervisor host itself may be compromised. Which of the following is the MOST effective immediate action to contain the spread and secure the environment?
⚠ Common exam trap
Watch out — candidates often choose to run antivirus scans or apply patches first, mistakenly believing these are immediate containment actions, when in reality they are slow, disruptive, and ineffective against an actively spreading ransomware outbreak on a compromised host.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disconnect the physical host from the network immediately.
Immediately disconnecting the physical host from the network is the most effective immediate action to contain the spread of ransomware. Since the host is compromised and the Type 2 hypervisor runs on top of a Windows Server OS, the attacker can pivot from the host to any VM via the virtual switch. Cutting network connectivity stops all lateral movement and outbound command-and-control traffic, buying time for forensic analysis and remediation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Run a full antivirus scan on the host operating system.
Why it's wrong here
A scan may not detect sophisticated ransomware and is not immediate enough.
- ✓
Disconnect the physical host from the network immediately.
Why this is correct
Isolating the host stops the ransomware from spreading to other systems and buys time for remediation.
- ✗
Apply the latest security patches to the hypervisor software.
Why it's wrong here
Patching does not remove an existing compromise on the host.
- ✗
Restore all VMs from known clean backups taken before the attack.
Why it's wrong here
If the host is compromised, restored VMs could be re-infected immediately.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.