mediumMultiple ChoiceObjective-mapped
SSCP Practice Question: A small business experienced a ransomware attack…
A small business experienced a ransomware attack that encrypted all files on the file server. They have no backups. The attacker demands a ransom. The CEO asks for advice. Which recommendation should the incident responder give?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Contact law enforcement and attempt decryption from public tools
Contacting law enforcement and attempting decryption using public tools (such as those from the No More Ransom project) is the recommended first step. Law enforcement can provide guidance and may have decryption keys. Paying the ransom (C) is discouraged as it funds criminals and does not guarantee data recovery. Wiping the server and restoring from cloud sync (B) is not possible because no backups exist. Reinstalling the OS and rebuilding data manually (D) is extremely time-consuming and likely infeasible without backups.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Contact law enforcement and attempt decryption from public tools
Why this is correct
Law enforcement can provide guidance, and free decryption tools may be available for some ransomware strains.
- ✗
Wipe the server and restore from the cloud sync if available
Why it's wrong here
No backups exist, and cloud sync would also be encrypted if active during the attack.
- ✗
Pay the ransom immediately to regain access
Why it's wrong here
Paying ransoms is illegal in some jurisdictions and does not guarantee decryption.
- ✗
Reinstall the OS and rebuild data from manual copies
Why it's wrong here
Manual copies likely do not exist, and rebuilding from scratch is impractical.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 920 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.