CompTIA Exam SY0-601 Topic 4 Question 58 Discussion

Actual exam question for CompTIA's SY0-601 exam

Question #: 58
Topic #: 4

A small business just recovered from a ransomware attack against its file servers by purchasing the decryption keys from the attackers. The issue was triggered by a phishing email and the IT administrator wants to ensure it does not happen again. Which of the following should the IT administrator do FIRST after recovery?

AScan the NAS for residual or dormant malware and take new daily backups that are tested on a frequent basis.

BRestrict administrative privileges and patch all systems and applications.

CRebuild all workstations and install new antivirus software.

DImplement application whitelisting and perform user application hardening.

Show Suggested Answer

Suggested Answer: A

The reason the company had to pay the ransom is because they did not have valid backups, otherwise they would have just restored their data. If your company just had to pay ransom and your boss says, 'Don't let this happen again', what is the first thing you are going to do. The only action after a ransomware attack is 'restore from backup'.

by Jutta at Dec 12, 2022, 09:23 AM

Limited Time Offer

25%

Off

Get Premium SY0-601 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Currently there are no comments in this discussion, be the first to comment!