CompTIA Security+ SY0-701

Set · 2026-10 practice questions

Ransomware is actively encrypting files on a workstation. The incident playbook authorizes network isolation while preserving evidence. Which action best fits that stage?

Select oneImmediately erase the workstation before collecting evidenceWait until all files have been encrypted before actingIsolate the workstation from the network and follow evidence-preservation proceduresReconnect shared drives to check whether they are affected

Questions & reviewAccuracy —

CorrectIncorrectUnanswered

Question link

CompTIA Security+ SY0-701

Report an error

Exam comments