CompTIA A+ Core 2 (220-1002) — Question 214

A recent ransomware attack caused several datasets to be inaccessible. Security technicians were able to mitigate any additional attacks and remove any unauthorized software. Which of the following should the technicians do NEXT?

Answer options

• A. Run an antivirus tool.
• B. Boot to the Recovery Console.
• C. Update the software firewall.
• D. Restore from backup.

Correct answer: C

Explanation

Updating the software firewall is crucial to ensure that any vulnerabilities exploited during the ransomware attack are patched, preventing future incidents. Running an antivirus tool (A) is important but should come after securing the environment. Booting to the Recovery Console (B) is unnecessary since the immediate threat has been mitigated, and restoring from backup (D) may not be the best first step without securing the system first.