高階ict-u08-d01
One school computer is held by ransomware. The best first set of actions is:
A. Disconnect the machine from the network, then restore from a clean backup rather than relying on paying✓ 答案
B. Pay the ransom and post the administrator password online
C. Disable every backup so the attacker cannot find them
D. Reuse one strong password across all school accounts
解說
Isolating the machine stops the spread. Restoring from a known clean backup recovers the data, whereas paying funds the attacker and does not guarantee recovery or deletion of the stolen data. Patching the entry point afterwards prevents a repeat.