Cert Master

KT-EPS Ransomware

File servers show mass .encrypted extensions and a ransom note. FIRST action?

Multiple choice — select one answer

Answer choices

  1. a. Pay ransom immediately without documentation, without security or identity team coordination per policy.
  2. b. Reboot all domain controllers first, without security or identity team coordination per policy.
  3. c. Delete backups to free space, without security or identity team coordination per policy.
  4. d. Isolate affected segments and preserve volatile evidence per IR plan

Architectural breakdown & explanation

Containment and evidence preservation precede recovery decisions.

Correct answer(s): d. Isolate affected segments and preserve volatile evidence per IR plan

Exam domain: Ransomware (20% weight on the official guide).

Official documentation & study links

Practice this certification

This page is one question from the KeyTrain's Key Training — Endpoint Security bank. Run a full timed practice exam with domain-weighted random questions in your browser.

Start practice exam View exam overview All certifications