These two phases of ransomware deployment frequently occur together to prevent mitigation of the malware before it can be initiated (select all that apply):

• Reconnaissance

• Delivery

• Installation

• Exploitation

• Command & Control (C&C)

In what phase of deployment does ransomware encrypt the impacted systems and exfiltrate data?

• Delivery

• Installation

• Command & Control (C&C)

• Actions on Objectives

According to law enforcement agencies, organizations should do which of the following to recover from ransomware events (select all that apply):

• Pay ransom to threat actors

• Utilize backup or recovery platforms

• Work with threat researchers to mitigate the outbreak

• Deploy stronger defenses to stop potential external connections into environment

What does SOAR stand for?

• Security Orchestration, Automation, and Response

• Security Operations, Automations, and Reports

• Secret Operations, Automations, and Reports

• Secure Organization, Automation, and Response

What is the single best defensive tactic against malware/ransomware in an organization environment?

• Strong antivirus/antimalware platform

• Next-generation firewalls

• Intrusion detection systems

• Employee education

What does ransomware use to lock files and prevent the victim from accessing them?

• Encryption

• Decryption

• Manipulation

• Illusion

What does TIP stand for?

• Transport In Protection

• Treat Intelligence Platform

• Treat Information Protection

• Treat In Protection

Which of the following are potential targets for a ransomware attack? (Select all that applies)

• Large organizations

• Critical infrastructure

• Small businesses

• Individuals

What does TTPs stand for?

• Tactics, Techniques and Procedures

• Techniques, Technology and Procedures

• Techniques, Technology and Plans

• Tactics, Telecommunication and Preparations

Initial access is often obtained by RansomEXX via a phishing email with an attached file. What file type does the attachment tend to be?

• .zip

• .pcap

• .pdf

• .docx