CompTIA A+ Core 2 (220-1202)Software TroubleshootingMedium
A user reports that all files on a shared network drive suddenly have a '.locked' extension and a ransom note demanding cryptocurrency payment has appeared. What should the technician do FIRST?
- ARun a full antivirus scan while the system remains connected
- BRestore files from the most recent backup immediately
- CPay the ransom to recover the files
- DDisconnect the affected system from the network
Show answer & explanationAnswer & explanation
Correct answer: D. Disconnect the affected system from the network
The first priority when ransomware is discovered is containment — disconnecting the infected system from the network prevents the encryption from spreading to other shared drives and systems before any scanning or restoration is attempted.
Why the other options are wrong
- A. Scanning while still connected risks further spreading the infection.
- B. Restoring backups before isolating the threat can result in re-infection.
- C. Paying the ransom is never recommended and doesn't guarantee recovery.
Ransomware Containment
The first response to detected ransomware is to isolate the infected system from the network to prevent further spread before remediation.
- Disconnect network cable or disable Wi-Fi immediately
- Never pay the ransom as a first response
- Identify, remediate, then restore from clean backups
Memory trick: Cut the cord before the fire spreads to the rest of the network