CompTIACompTIA
CAS-005 · Question #430
CAS-005 Question #430: Real Exam Question with Answer & Explanation
Sign in or unlock CAS-005 to reveal the answer and full explanation for question #430. The question stem and answer options stay visible for context.
Submitted by renata2k· Mar 6, 2026Security Operations
Question
A security administrator has isolated a computer system because it was targeted by a ransomware attack. Which of the following should the security administrator do to recover from this attack in the most secure way?
Options
- ACheck if file versioning is enabled and restore the files.
- BRestore the system from a baseline snapshot.
- CDetermine if the encryption key can be recovered. If it can, restore the files.
- DSeek approval from senior leadership to pay the ransom and unencrypt the files with the provided
Unlock CAS-005 to see the answer
You've previewed enough free CAS-005 questions. Unlock CAS-005 for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.