CompTIACompTIA
220-1202 · Question #216
220-1202 Question #216: Real Exam Question with Answer & Explanation
The correct answer is D: Isolate the system.. The technician should isolate the system immediately to prevent the ransomware from spreading to other machines or network resources before taking any recovery actions.
Submitted by kev92· Mar 30, 2026Security
Question
A user reports the icons on their desktop have changed. A technician investigates and discovers programs no longer open, files are inaccessible, and file extensions have been changed. When a ransom note appears on the display, which of the following should the technician do next?
Options
- AChange the extensions back.
- BRun antivirus scans.
- CRestore from a backup.
- DIsolate the system.
Explanation
The technician should isolate the system immediately to prevent the ransomware from spreading to other machines or network resources before taking any recovery actions.
Topics
#Ransomware#Incident response#System isolation
Community Discussion
No community discussion yet for this question.