220-1102 · Question #515
A branch office suspects a machine contains ransomware. Which of the following mitigation steps should a technician take first?
The correct answer is D. Quarantine the system.. The immediate first step when ransomware is suspected is to quarantine the affected system by isolating it from the network to prevent the malware from spreading to other machines or network shares.
Question
A branch office suspects a machine contains ransomware. Which of the following mitigation steps should a technician take first?
Options
- ADisable System Restore.
- BRemediate the system.
- CEducate the system user.
- DQuarantine the system.
How the community answered
(56 responses)- A13% (7)
- B2% (1)
- C4% (2)
- D82% (46)
Why each option
The immediate first step when ransomware is suspected is to quarantine the affected system by isolating it from the network to prevent the malware from spreading to other machines or network shares.
Disabling System Restore is generally not the first step; the immediate priority is containment, not disabling recovery options.
Remediating the system (e.g., removing the ransomware) is a subsequent step that should only be performed after the system has been quarantined to prevent further infection.
Educating the system user is an important long-term preventive measure but is not the immediate first technical step to mitigate an active ransomware infection.
Quarantining the system, typically by disconnecting it from the network, is the crucial first step to prevent the suspected ransomware from spreading to other computers or network resources, thereby containing the potential damage.
Concept tested: Ransomware incident response - containment
Source: https://www.cisa.gov/stopransomware/ransomware-guide
Topics
Community Discussion
No community discussion yet for this question.