Ransomware Attacks GCIL Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A company wants to reduce the risk of ransomware infections originating from email attachments. Which preventive control is most effective at blocking malicious attachments before they reach end users?

   • AEnabling multi-factor authentication (MFA) for email accounts.
   • BImplementing a backup strategy with offline backups.
   • CProviding annual security awareness training to all employees.
   • DDeploying an email security gateway that scans attachments in a sandbox and blocks malicious files.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   During a ransomware incident, the incident response team identifies that the initial access was gained through a phishing email that delivered a malicious attachment. The attacker then used PowerShell to disable security tools and created a scheduled task for persistence. Which stage of the ransomware attack lifecycle does the creation of a scheduled task represent?

   • APersistence and privilege escalation
   • BRansom demand
   • CInitial access
   • DData exfiltration
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which sequence correctly represents the typical ransomware attack lifecycle?

   • ALateral movement, initial access, payment, encryption, ransom demand, decryption
   • BRansom demand, encryption, initial access, lateral movement, payment, decryption
   • CInitial access, lateral movement, encryption, ransom demand, payment, decryption
   • DInitial access, encryption, lateral movement, ransom demand, payment, decryption
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An organization's security team is reviewing its defenses against ransomware. They want to implement controls that address the 'initial access' stage of the ransomware attack lifecycle. Which control is most directly relevant to this stage?

   • AImplementing endpoint detection and response (EDR) to detect ransomware execution.
   • BDeploying email filtering and web filtering to block malicious attachments and drive-by downloads.
   • CConducting regular security awareness training for employees.
   • DImplementing a robust backup and recovery plan.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A hospital experiences a ransomware attack. The attackers encrypt patient records and then threaten to publish the data on the dark web if the ransom is not paid. The hospital's leadership is considering whether to pay. Which factor should the incident commander weigh most heavily when advising leadership on the decision?

   • AThe potential legal and regulatory obligations, including breach notification laws and patient privacy regulations.
   • BThe cost of the ransom compared to the cost of rebuilding the affected systems from backups.
   • CThe reputation damage that would result from the data being publicly leaked.
   • DThe likelihood that the attackers will actually provide a working decryption key after payment.
   Reveal Solution Discussion Select an answer first