Exam Preview

Incident Response Case Study

How to correctly handle an ongoing ransomware infection:

Security Operations (Incident Response) Question 1 of 1

A SOC analyst identifies that an accounting workstation is encrypting files across an enterprise SMB shared drive. What is the IMMEDIATE containment step?

Isolate the affected workstation from the network (unplug network cable or disconnect via EDR) without powering down the machine.

Immediately pull the power plug to stop the disk write process.

Restore backups on the SMB shares before conducting forensic analysis.

Contact the employee to request they close all running programs.

✓ CompTIA Technical Rationale: Option A is correct. During containment, isolating the infected host halts lateral spread without wiping volatile RAM artifacts (cryptographic keys, running processes, active C2 network sockets) essential for root-cause forensic analysis.

Practice more CompTIA questions free →

Transparent Pricing

CompTIA Security+ Simulator Plans

One-time payment in USD. Instant access. Desktop, tablet, and mobile ready.

Express Plan

Focused drill on all 5 domains

$16 / 30 days

Full bank of 650+ questions
90Q timed simulation mocks
Detailed rationales & acronym breakdowns
Ports & protocols flashcards

Recommended Plan

Comprehensive preparation recommendation

$34 / 90 days

Everything in Express Plan
90 days of continuous access
Performance-Based Question practice
Advanced analytics per SY0-701 domain
Verifiable certificate of completion

Professional Plan

Study at your own flexible pace

$61 / 180 days

Everything in Recommended Plan
6 full months of access
All question bank updates included
Priority technical assistance

Want to test the platform before purchasing?

Start Free Trial →