Ransomware Attacks GCIL Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   During a ransomware incident, the response team identifies that the attacker used a compromised VPN account to gain access, then moved laterally to the domain controller and deployed ransomware via Group Policy. The team has isolated the affected systems. Which step should be taken NEXT to eradicate the threat?

   • AReimage all workstations and servers from known-good media.
   • BDisconnect the VPN server from the internet to prevent further access.
   • CReset the compromised VPN account credentials and revoke its sessions.
   • DRestore the domain controller from a backup that predates the compromise.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security analyst is reviewing logs from a ransomware incident and identifies the following sequence: (1) a user clicked a link in a phishing email, (2) the attacker used a vulnerability in a web browser to execute code, (3) the attacker escalated privileges using a known Windows vulnerability, (4) the attacker deployed ransomware that encrypted files. Which stage of the ransomware attack lifecycle does the privilege escalation represent?

   • ALateral movement, because the attacker moved to other systems.
   • BData exfiltration, because the attacker accessed sensitive data.
   • CInitial access, because the attacker gained access to the system.
   • DPrivilege escalation, which is a distinct stage after initial access and before lateral movement or encryption.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A user reports that their computer is displaying a full-screen message demanding payment to unlock the system, and the mouse and keyboard are unresponsive. The system does not appear to have any files encrypted, but the user cannot access the desktop. Which type of ransomware is most likely involved?

   • AA drive-by download that installed adware causing the full-screen message.
   • BLocker ransomware, which restricts access to the system without encrypting files.
   • CA remote access trojan (RAT) that locks the screen as a prank.
   • DEncrypting ransomware, which encrypts files and then displays a ransom note.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company's security operations center (SOC) detects that a workstation is attempting to connect to multiple internal file shares and is executing a series of PowerShell commands that enumerate domain admin groups. The SOC suspects early-stage ransomware activity. Which immediate action should the incident response team take to contain the potential outbreak?

   • ARun a full antivirus scan on the workstation to detect and remove the malware.
   • BChange the passwords of all domain admin accounts and enforce a forced password reset for all users.
   • CIsolate the affected workstation from the network while preserving its volatile data for forensic analysis.
   • DShut down the workstation immediately to prevent any further malicious activity.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Why is a robust backup strategy considered a critical preventive control against ransomware?

   • AIt ensures that ransomware is automatically detected and removed
   • BIt eliminates the need for other security controls
   • CIt allows organizations to restore encrypted data without paying the ransom
   • DIt prevents ransomware from entering the network
   Reveal Solution Discussion Select an answer first