SC-100 Ransomware Practice Questions

Your company wants to optimize ransomware incident investigations. You need to recommend a plan to investigate ransomware incidents based on the Microsoft Detection and Response Team (DART) approach. Which three actions should you recommend performing in sequence in the plan? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Match each item to its target.

Correct answer: 1 = Assess the current situation and identify the scope.; 2 = Identify which line-of-business (LOB) apps are unavailable due to a ransomware incident.; 3 = Identify the compromise recovery process.

You are designing a ransomware response plan that follows Microsoft Security Best Practices. You need to recommend a solution to minimize the risk of a ransomware attack encrypting local user files. What should you include in the recommendation?

• AA. Microsoft Defender for Endpoint
• BB. Windows Defender Device Guard
• CC. protected folders
• DD. Azure Files
• EE. BitLocker Drive Encryption (BitLocker)