SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A user's laptop suddenly starts renaming many files and showing a ransom note. The laptop is still connected to Wi-Fi. What is the best immediate action?
⚠ Common exam trap
Watch out — candidates often think rebooting (Option A) will stop the malicious process, but ransomware often persists across reboots via registry run keys or scheduled tasks, and the immediate priority is containment by disconnecting the network.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disconnect the laptop from the network immediately.
Ransomware actively encrypts files and may communicate with a command-and-control (C2) server over the network to exfiltrate data or receive encryption keys. Disconnecting the Wi-Fi immediately stops further C2 communication, prevents lateral movement to other devices, and halts any ongoing data exfiltration. This containment step is critical before any remediation like system imaging or forensic analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reboot the laptop to stop the malicious process.
Why it's wrong here
Rebooting the laptop is ineffective as a first response because ransomware often persists through scheduled tasks, services, or registry run keys that reinitiate encryption after startup. It also destroys volatile memory artifacts (e.g., encryption keys, process handles) that are critical for forensic triage. Meanwhile, any partially encrypted files remain inaccessible, and if the system is configured to auto-reconnect to the network, the infection can continue spreading to other systems.
- ✓
Disconnect the laptop from the network immediately.
Why this is correct
Disconnecting the laptop from the network is the correct immediate action because most ransomware variants actively scan for and encrypt network shares, mapped drives, and adjacent hosts the moment they execute. Cutting the Ethernet cable or disabling Wi-Fi halts lateral movement, prevents the encryption of remote files, and helps preserve the integrity of the evidence for later analysis. This containment step also stops any command-and-control communication that might allow the attacker to escalate access or exfiltrate data.
- ✗
Delete the ransom note and continue working.
Why it's wrong here
Deleting the ransom note and continuing to work doesn't address the underlying malware, which remains resident in memory and on disk and will continue encrypting new or modified files. It also risks corrupting forensic evidence, since the note often contains the attacker's encryption key identifier or payment address useful for decryption efforts. Most critically, 'working' on the system while ransomware is active gives the malware more time to propagate to network resources and increases data loss.
- ✗
Change the user's password and wait for more details.
Why it's wrong here
Changing the user's password is a defensive step against credential theft but does nothing to halt the already-running ransomware process or prevent it from encrypting additional local files. Waiting for more details allows the malware to traverse the network and damage shared folders, while password expiration policies could even lock the user out of the system if not synchronized. The proper workflow is to isolate the host first, then reset credentials as part of broader remediation and EDR investigation.
Go deeper
Related to this question
Learn chapter
Network-Based Attacks
Key term
Ransomware
Ransomware is a type of malicious software that encrypts a victim's files or locks them out of their system, demanding payment, usually in cryptocurrency, to restore access.
Key term
Lateral movement
Lateral movement is the technique attackers use to move through a network from one compromised system to another, seeking sensitive data or higher privileges.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.