Ransomware Attacks GCIL Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Why is law enforcement involvement recommended in ransomware incidents?

   • ATo potentially identify the attackers and assist in recovery efforts
   • BTo ensure that the organization's data is decrypted without payment
   • CTo guarantee that the ransom will be paid by the government
   • DTo prevent the organization from being fined for the breach
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the first step an incident responder should take when a ransomware infection is suspected on a critical server?

   • AIsolate the affected system from the network
   • BPay the ransom immediately to stop the attack
   • CReboot the system to clear the infection
   • DRun a full antivirus scan on the system
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What distinguishes locker ransomware from encryption-based ransomware?

   • ALocker ransomware encrypts individual files, while encryption-based ransomware locks the entire operating system
   • BLocker ransomware is delivered via email, while encryption-based ransomware is delivered via exploit kits
   • CLocker ransomware blocks access to the device or system, while encryption-based ransomware encrypts files and data
   • DLocker ransomware is a type of scareware, while encryption-based ransomware is a type of wiper malware
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company has been hit by a ransomware attack that encrypted its systems and exfiltrated data. The attackers are demanding a ransom in cryptocurrency. The company's cyber insurance policy covers ransom payments, but the insurer requires that the company obtain a decryption tool from the attackers before payment. The company's legal counsel warns that paying the ransom may violate sanctions if the attackers are on a sanctions list. The company's board wants to restore operations quickly. Which course of action is most appropriate?

   • ANegotiate with the attackers to lower the ransom amount before paying.
   • BRefuse to pay the ransom and rely solely on backups, ignoring the exfiltration threat.
   • CConsult with legal counsel and law enforcement to determine if payment is legally permissible, and consider alternative recovery options such as backups.
   • DPay the ransom immediately because the insurance covers it and the decryption tool is guaranteed.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company has a mature security program but is concerned about ransomware. They have implemented EDR, email filtering, and user awareness training. However, they have not yet implemented a robust backup strategy. The company's leadership wants to prioritize the next investment. Which option provides the most comprehensive improvement to ransomware resilience?

   • ADeploy a next-generation firewall with intrusion prevention.
   • BPurchase cyber insurance to cover ransom payments.
   • CInvest in a 3-2-1 backup strategy with immutable storage.
   • DIncrease the frequency of security awareness training to monthly.
   Reveal Solution Discussion Select an answer first