Exam 220-1002 topic 1 question 334 discussion

Seems to me the question asks very specifically about restoring the files, not the malware process, not the next step in the process but how would one get back files that are encrypted due to ransomware. The answer to that is that you have to restore from a last known good back up. If it asked about how to deal with the malware that may have resulted in the ransomware or what is the first thing to do, then the other answers make sense.

the question should ask what the technician should do "First" to recover the files. but it only asks what to do recover files only which should be restore files....

It looks like it doesn't make sense, but have to really pay attention to the details. Everybody I thinking is a ransomware and I think is right. Now... we are talking about folders on the network that ate claimed as locked. A ransomware really unlikely is in the server, but is probably in the device. If you try to access from a clean computer, probably the folders will still be accessible. So the problem is not the network, but the device. The solution is to disconnect the device and sort it. Once reconnected to the network the folders will be available again

The question is very specific by asking what to do to "recover the files" so the answer should be A. It's not asking what to do First or Next...

It's CompTIA people...the answer is D.

CompTIA logic, always quarantine threats before taking other action.

Its a network folder, those are usually on a server and accessed via user profile. Doing anything to the computer most likely wouldn't resolve the issue. Its either A or C