Cert Master

KT-EPS Ransomware

A subsidiary reports encrypted file shares but still has network connectivity. IMMEDIATE action?

Multiple choice — select one answer

Answer choices

  1. a. Segment affected VLANs and disable compromised service accounts per runbook
  2. b. Pay a small ransom immediately to test whether attackers provide working keys
  3. c. Announce full recovery on social media to reassure customers during investigation, without security or identity team coordination per policy.
  4. d. Restore from the newest online snapshot without verifying backup integrity first, without security or identity team coordination per policy.

Architectural breakdown & explanation

Segmentation limits spread; preserve evidence before mass restore attempts.

Correct answer(s): a. Segment affected VLANs and disable compromised service accounts per runbook

Exam domain: Ransomware (20% weight on the official guide).

Official documentation & study links

Practice this certification

This page is one question from the KeyTrain's Key Training — Endpoint Security bank. Run a full timed practice exam with domain-weighted random questions in your browser.

Start practice exam View exam overview All certifications