CompTIA A+ Core 2 (220-1102) — Question 18

A user calls the help desk to report that none of the files on a PC will open. The user also indicates a program on the desktop is requesting payment in exchange for file access. A technician verifies the user's PC is infected with ransomware. Which of the following should the technician do FIRST?

Answer options

• A. Scan and remove the malware.
• B. Schedule automated malware scans.
• C. Quarantine the system.
• D. Disable System Restore.

Correct answer: C

Explanation

The first step in dealing with ransomware is to quarantine the affected system to prevent the malware from spreading and to protect other devices on the network. Scanning and removing malware, scheduling scans, and disabling System Restore are important, but they should come after the system is isolated to contain the threat.