This is because remote wipe allows the data on the smartphone to be erased remotely, which helps to ensure that sensitive data does not fall into the wrong hands.

See the Explanation for the solution.
Explanation:
Host 2 and Media Server put them to Quarantine.

The best way for a technician to return the device to service safely is to reinstall the operating system. This is because the device is infected by ransomware, which is a form of malware that encrypts files and demands payment for decryption. Reinstalling the operating system will erase the ransomware and restore the device to its original state. However, this will also delete any data that was not backed up before the infection.
Therefore, it is important to have regular backups of critical data and protect them from ransomware attacks1.
The other options are not effective or safe for ransomware recovery. Running an AV scan may not detect or remove the ransomware, especially if it is a new or unknown variant. Installing a software firewall may prevent future attacks, but it will not help with the current infection. Performing a system restore may not work if the ransomware has corrupted or deleted the restore points. Complying with the on-screen instructions is not advisable, as it will encourage the attackers and there is no guarantee that they will provide the decryption key after receiving the payment.
To prevent and recover from ransomware attacks, it is recommended to follow some best practices, such as234:
* Use strong passwords and multifactor authentication for all accounts and devices.
* Keep all software and firmware updated with the latest security patches.
* Avoid opening suspicious or unsolicited emails and attachments.
* Educate users and staff on how to recognize and report phishing and social engineering attempts.
* Use antivirus software and enable real-time protection.
* Enable network segmentation and firewall rules to limit the spread of ransomware.
* Implement a Zero Trust security model to verify all requests and devices before granting access.
* Create and test backups of critical data and store them offline or in a separate network.
* Recover safely by isolating the infected devices, identifying the ransomware variant, and restoring data from backups.
* Report any ransomware incidents to law enforcement agencies and seek help from experts.

When a user's cursor is moving on its own and unauthorized data transfer is occurring, the first step a technician should take is to Quarantine the workstation. This involves isolating the affected system from the network to prevent the spread of malware or unauthorized access to other parts of the network. Quarantining helps in containing the threat and provides a safe environment to investigate and remediate the issue without risking further contamination or data loss.

Group Policy is a feature of Windows that allows administrators to centrally manage and apply policies and settings to computers and users on a domain3. Group Policy can be used to configure network drives, printers, security settings, desktop preferences, and other configurations for all users' workstations3. Network and Sharing Center, net use, User Accounts, and regedit are not tools that can accomplish this task.