Antivirus software indicates that a workstation is infected with ransomware that cannot be quarantined. Which of the following should be performed FIRST to prevent further damage to the host and…

Question

Options

• APower off the machine.
• BRun a full antivirus scan.
• CRemove the LAN card.
• DInstall a different endpoint solution.

• A
  81% (30)
• B
  5% (2)
• C
  11% (4)
• D
  3% (1)

Explanation

Ransomware is a type of malware that encrypts the files on a system and demands a ransom for their decryption. Ransomware can also spread to other systems on the network or exfiltrate sensitive data to the attackers. Therefore, it is important to isolate the infected machine as soon as possible to contain the infection and prevent further damage. Powering off the machine is a quick and effective way of disconnecting it from the network and stopping any malicious processes running on it. The other options are not directly related to preventing ransomware damage or may not be effective. Running a full antivirus scan may not be able to detect or remove the ransomware, especially if it is a new or unknown variant. Removing the LAN card may disconnect the machine from the network, but it may not stop any malicious processes running on it or any data encryption or exfiltration that has already occurred. Installing a different endpoint solution may not be possible or helpful if the system is already infected and locked by

No community discussion yet for this question.