Ransomware Attacks GCIL Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A manufacturing company discovers that files on several file servers are encrypted with a .locked extension. The initial infection is traced to a user who opened a malicious attachment from a phishing email. The attacker then used compromised credentials to move laterally and disabled the backup agent on the servers before deploying the ransomware. Which action should the incident response team take FIRST to limit further spread?

   • ARun a full antivirus scan on all endpoints to identify the ransomware binary.
   • BNotify law enforcement and begin ransom negotiation with the attackers.
   • CRestore the encrypted files from the most recent backup immediately.
   • DIsolate the affected file servers from the network and disable the compromised user account.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A hospital experiences a ransomware attack that encrypts its electronic health records (EHR) system, forcing the hospital to divert ambulances to other facilities for 48 hours. The hospital also faces a regulatory fine for failing to protect patient data. Which impact category does the ambulance diversion represent?

   • AOperational impact, because the hospital's ability to provide services was disrupted.
   • BReputational impact, because patients may lose trust in the hospital.
   • CFinancial impact, because the hospital lost revenue during the diversion.
   • DLegal impact, because the hospital may face lawsuits.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   During a ransomware incident, the incident response team has isolated the affected systems and is now planning eradication and recovery. The organization has a backup strategy that includes daily snapshots stored on a separate NAS device. Which step should be taken BEFORE restoring from backups?

   • AChange all administrative passwords and disable compromised accounts.
   • BNotify law enforcement and provide them with a sample of the ransomware.
   • CDisconnect the NAS from the network to prevent further spread.
   • DVerify that the backups are not encrypted or corrupted by the ransomware.
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A company is hit by a ransomware variant that is known to be offered as Ransomware-as-a-Service (RaaS). The affiliate who deployed the ransomware used a phishing email to gain initial access, then used a PowerShell script to disable Windows Defender and delete shadow copies. The company has a backup solution that stores copies on a separate NAS device. During the incident, the attackers also exfiltrated data before encryption. The company is considering paying the ransom. Which factor is MOST important in deciding whether to pay?

   • AThe fact that the data was exfiltrated, meaning payment may not prevent the leak.
   • BThe legal implications of paying a ransom to a sanctioned entity.
   • CThe cost of the ransom compared to the cost of restoring from backups.
   • DThe reputation of the RaaS affiliate in providing decryption keys.
   Reveal Solution Discussion Select an answer first
6. 50expert · hard

   A company's incident response team is analyzing a ransomware attack and discovers that the attackers used a legitimate administrative tool to disable security software and then deployed ransomware. The team also finds evidence that the attackers attempted to delete shadow copies and disable recovery features. Which ransomware family or tactic is most consistent with this behavior?

   • AScareware, which uses fake alerts to trick users.
   • BTactics commonly used by Ryuk ransomware, which often uses legitimate tools like PowerShell and disables recovery options.
   • CLocker ransomware, which locks the system without using administrative tools.
   • DRansomware-as-a-service (RaaS) model, which is a distribution model, not a tactic.
   Reveal Solution Discussion Select an answer first