Ransomware Attacks GCIL Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A hospital is hit by ransomware that encrypts patient records and threatens to leak them. The hospital has a backup strategy, but the backups are also encrypted. The attackers demand a ransom. The hospital's leadership is considering paying. Which factor should be given the MOST weight in the decision?

   • AThe legal obligation to report the breach to regulators and patients.
   • BThe potential harm to patients if their data is leaked.
   • CThe cost of the ransom compared to the cost of rebuilding the systems.
   • DThe fact that backups are encrypted, leaving no other way to recover the data.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A multinational company is hit by ransomware that affects its European and US operations. The attackers demand payment in cryptocurrency. The company's legal team is concerned about GDPR implications. Which action is MOST important for the company to take?

   • ANotify the relevant data protection authorities within 72 hours of becoming aware of the breach.
   • BContact the attackers to negotiate a lower ransom.
   • CPay the ransom immediately to prevent the data from being leaked.
   • DWait until the investigation is complete before notifying authorities.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which of the following is a financial impact that a ransomware attack can have on an organization?

   • ADecreased insurance premiums due to proven risk
   • BIncreased revenue from new security product sales
   • CCosts associated with incident response, forensic investigation, and system restoration
   • DNo financial impact if the ransom is not paid
   Reveal Solution Discussion Select an answer first
5. 39application · easy

   A user reports that their computer is locked and displays a message demanding payment to unlock the system. The user cannot access any files or applications. Which type of ransomware is this?

   • AEncryption-based ransomware
   • BDouble extortion ransomware
   • CRansomware-as-a-service (RaaS)
   • DLocker ransomware
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A hospital's IT team discovers that a ransomware group has encrypted critical patient-care systems and is threatening to publish sensitive patient records unless a ransom is paid. The hospital has offline backups that were not affected, and the incident response team has confirmed that the attackers exfiltrated a large volume of data before encryption. The hospital's legal counsel is concerned about regulatory notification obligations. Which action should the incident commander prioritize?

   • AFocus solely on containing the outbreak and eradicating the malware before considering recovery or legal obligations.
   • BBegin recovery from the offline backups while simultaneously engaging law enforcement and legal counsel to assess notification requirements.
   • CNotify the public immediately about the breach before confirming the scope of exfiltration.
   • DImmediately pay the ransom to prevent the publication of sensitive patient records and minimize reputational damage.
   Reveal Solution Discussion Select an answer first