220-1102 Question 409
Single answerRansomwareA help desk technician receives a call from an employee who says all of the files on a shared department drive suddenly have strange extensions and cannot be opened. A text file in every folder demands payment in cryptocurrency to restore access. Other users are still actively connected to the same shared drive. Which action should the technician take FIRST to best limit the impact of this incident?
- A
Disconnect the affected systems and file share from the network to contain the spread
- B
Run a full antimalware scan on the employee's workstation and wait for the results
- C
Pay the ransom immediately so the shared files can be recovered quickly
- D
Delete the ransom note files and restore normal file permissions on the share
Show answer and explanation
Correct answer: A
Explanation
This question tests practical incident response for ransomware, a core security topic in A+ Core 2. In a real environment, the technician should first contain the incident by isolating infected endpoints and, if necessary, disconnecting affected shares or network segments. After containment, the organization can follow standard response steps such as identifying the scope, notifying the appropriate internal security or management personnel, preserving evidence, eradicating malware, and restoring data from known-good backups. This aligns with common security guidance from organizations such as CISA and NIST, which emphasize containment and recovery planning rather than paying ransom demands.
- A. Correct.
Correct. The first priority in a suspected ransomware incident is containment. Isolating affected hosts and shared resources from the network helps prevent further encryption of files and limits lateral spread to additional systems. In A+ Core 2 incident-response scenarios, the best immediate action is to stop the damage before moving on to remediation and recovery.
- B. Incorrect.
Incorrect. Running antimalware is a reasonable later step during remediation, but it is not the first action when ransomware is actively impacting a shared resource. If the system remains connected, the malware may continue encrypting local and network data while the scan runs.
- C. Incorrect.
Incorrect. Paying the ransom is not an appropriate first response and does not guarantee recovery. Security best practices and law enforcement guidance generally discourage payment because attackers may not provide a working decryption key and payment can encourage further criminal activity.
- D. Incorrect.
Incorrect. Deleting ransom notes or changing permissions does not remove the malware or stop active encryption. This action addresses a symptom rather than the threat itself and wastes valuable time during the containment phase.