CompTIA Exam SY0-601 Topic 1 Question 61 Discussion

Actual exam question for CompTIA's SY0-601 exam

Question #: 61
Topic #: 1

A small business just recovered from a ransomware attack against its file servers by purchasing the decryption keys from the attackers. The issue was triggered by a phishing email and the IT administrator wants to ensure it does not happen again. Which of the following should the IT administrator do FIRST after recovery?

AScan the NAS for residual or dormant malware and take new daily backups that are tested on a frequent basis.

BRestrict administrative privileges and patch all systems and applications.

CRebuild all workstations and install new antivirus software.

DImplement application whitelisting and perform user application hardening.

Show Suggested Answer

Suggested Answer: A

by Kristofer at Feb 08, 2023, 08:28 AM

Limited Time Offer

25%

Off

Get Premium SY0-601 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Arczz Jones

2 years ago

B) Restrict administrative privileges and patch all systems and applications. Restricting administrative privileges helps to limit the scope of potential damage by preventing unauthorized access and reducing the ability for malware to spread throughout the network. This step is crucial for improving overall security posture.

upvoted 2 times

...