Study. uk . com
  1. Home
  2. All questions
  3. Question 442

CompTIA Security+ study material · question 442 of 611

On discovering ransomware, an administrator wants to wipe and rebuild the affected servers immediately. What should happen first?

  1. Isolate the systems and preserve evidence
  2. Restore from the most recent snapshot
  3. Pay the ransom to obtain the key
  4. Disable all user accounts
Show the answer

Answer: A. Isolate the systems and preserve evidence

The forensic record informs both the recovery and the notification obligations, and wiping destroys it.

Source: CISA #StopRansomware Guide (CISA) — CISA #StopRansomware Guide › Ransomware Response Checklist

Challenge yourself on this topic → Study as cards