nerdexam
EC-Council

212-82 · Question #112

You are working as a Security Consultant for a top firm named Beta Inc. Being a Security Consultant, you are called in to assess your company's situation after a ransomware attack that encrypts…

The correct answer is A. Identify and isolate infected devices to prevent further spread. The immediate and most critical action after identifying a ransomware attack is to prevent its further spread to minimize damage and preserve systems not yet infected.

Submitted by tunde_lagos· Mar 6, 2026Cloud Security Operations & Incident Response

Question

You are working as a Security Consultant for a top firm named Beta Inc. Being a Security Consultant, you are called in to assess your company's situation after a ransomware attack that encrypts critical data on Beta Inc. servers. What is the MOST critical action you have to take immediately after identifying the attack?

Options

  • AIdentify and isolate infected devices to prevent further spread.
  • BRestore critical systems from backups according to the BCP.
  • CAnalyze the attack vector to identify the source of the infection.
  • DPay the ransom demand to regain access to encrypted data.

How the community answered

(37 responses)
  • A
    81% (30)
  • B
    3% (1)
  • C
    5% (2)
  • D
    11% (4)

Why each option

The immediate and most critical action after identifying a ransomware attack is to prevent its further spread to minimize damage and preserve systems not yet infected.

AIdentify and isolate infected devices to prevent further spread.Correct

Identifying and isolating infected devices is the MOST critical immediate action to prevent the ransomware from spreading further across the network, limiting the scope of the attack and protecting uncompromised systems from encryption.

BRestore critical systems from backups according to the BCP.

Restoring critical systems from backups is a recovery phase action and should only be performed after the threat has been contained and eradicated to prevent re-infection.

CAnalyze the attack vector to identify the source of the infection.

Analyzing the attack vector is crucial for understanding the breach and improving defenses, but it is a post-containment activity and not the immediate action to stop ongoing damage.

DPay the ransom demand to regain access to encrypted data.

Paying the ransom is generally discouraged as it does not guarantee data recovery, funds criminal operations, and can mark the organization as a vulnerable target for future attacks.

Concept tested: Ransomware incident response - immediate actions

Source: https://www.cisa.gov/stopransomware/ransomware-guide

Topics

#incident response#ransomware#containment#disaster recovery

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 212-82 Practice