At 10:30 AM, during routine monitoring, Tier 1 SOC analyst Jennifer detects unusual network traffic and confirms an active LockBit ransomware infection targeting systems in the finance department…

Question

Options

• AEvidence gathering and forensic analysis
• BEradication
• CNotification
• DContainment

• A
  9% (2)
• C
  5% (1)
• D
  86% (19)

Explanation

Isolating the finance department’s VLAN is a classic containment action. Containment focuses on limiting spread, stopping additional damage, and preventing further compromise while the team stabilizes the environment. In ransomware incidents, rapid segmentation and isolation can prevent lateral movement, reduce the number of encrypted systems, and preserve critical services. The scenario shows escalation to leadership, activation of the IRT, and immediate network isolation-all consistent with containment. Eradication would come next and involves removing ransomware artifacts, closing exploited vulnerabilities, eliminating persistence mechanisms, and ensuring the threat cannot return. Evidence gathering and forensic analysis may occur in parallel after containment, especially to preserve volatile evidence, but the central action described is isolation to stop spread. Notification involves informing stakeholders (legal, leadership, regulators) and is not the primary activity described. From a SOC playbook standpoint, containment is often the first priority increases operational and financial impact. Therefore, the current phase is containment.

No community discussion yet for this question.