A company's file server was hit by ransomware that encrypted critical files. The IT team has backups, but the most recent backup is from two days ago. The team needs to recover the files with minimal data loss. What should the team do first?

Restore the files from the most recent backup and then apply any incremental backups if available.

Delete the encrypted files and recreate them manually.

Reimage the server and restore from the oldest backup to ensure the malware is removed.

Attempt to decrypt the files using a tool downloaded from the internet.

CompTIASecurityX (CASP+)

Domain 4Objective 4

Incident Response CAS-005 Practice Questions (Page 6)

Part of the Security operations domain, which accounts for 22% of the CAS-005 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~14–24 in this domain), expect 4–6 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

7concepts

22%of the exam

Questions 26–26

26application · medium
A company's file server was hit by ransomware that encrypted critical files. The IT team has backups, but the most recent backup is from two days ago. The team needs to recover the files with minimal data loss. What should the team do first?
Select an answer first

Finished these 1 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CAS-005

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CAS-005” is a trademark of its owner, used for identification only.

Incident Response CAS-005 Practice Questions (Page 6)

Questions 26–26

A company's file server was hit by ransomware that encrypted critical files. The IT team has backups, but the most recent backup is from two days ago. The team needs to recover the files with minimal data loss. What should the team do first?

Keep studying — Security operations