Learning track 02 · about 5 minutes
Ransomware
Challenge
Make five defensive decisions across ransomware delivery, early warning signs, containment and recovery.
Start this trackView all learning tracks →Ransomware Challenge
Make the call
B I U≡ ≡ ▦AlignmentΣ ▤Number
Enable content to display this invoice.
Scenario 1 of 5 · Question the file
An urgent spreadsheet arrives
A supplier invoice asks you to enable editing and security-bypassing content. What should you do?
Select an answer to continue.
Unexpected active content is a common delivery path. Verify using known supplier details and let security inspect the file.
Remember: do not weaken document protections for an unexpected file.
Your files are encrypted
A payment is demanded to restore access.
Scenario 2 of 5 · Catch the signal
Files suddenly change names
Shared files gain unfamiliar extensions and a payment note appears. What is the best immediate action?
Select an answer to continue.
This is consistent with active ransomware. Disconnecting can reduce further encryption and spread while preserving evidence.
Remember: contain first; do not experiment with affected files.
Recovery snapshots
Restore test · Isolated environment
Scenario 3 of 5 · Protect recovery
Which backup is resilient?
Which backup approach offers the strongest protection against ransomware reaching the recovery copy?
Select an answer to continue.
Offline or immutable backups with separate access controls are harder for ransomware to encrypt or delete.
Remember: backups must be isolated, protected and regularly tested.
Virus & threat protection
Real-time protection
● OnProtection monitors files and applications.
“Turn off protection first.”
“The urgent update will not install otherwise.”
Scenario 4 of 5 · Resist pressure
“Disable security for the update”
A caller claiming to be IT asks you to disable protection before installing an urgent update. What is safest?
Select an answer to continue.
Attackers use urgency and authority to remove controls. A separate, known channel provides an independent check.
Remember: never disable protection on an unverified request.
Not connected
Wi-Fi disconnected · Ethernet unplugged
Security response · Case #2048
Device isolated. Awaiting responder instructions.
Scenario 5 of 5 · Preserve evidence
A device may be infected
After isolating the device, which action best supports the incident-response team?
Select an answer to continue.
Uncoordinated cleanup can destroy evidence or worsen damage. Follow your response team’s instructions after isolation.
Remember: preserve the device and let authorised responders lead.
Challenge complete
You read the signals.
This-device leaderboard
Your best attempts
Names and scores stay in this browser. A secure cohort leaderboard can be added with the future training platform.
Keep learning