A junior cybersecurity analyst has detected a ransomware attack on the company's servers and has activated the incident response team. Which is the next BEST course of action? ()

Question

Options

• AUpdate all server anti-virus software with the latest updates
• BGenerate support tickets to restore the affected systems to their previous state
• CInvestigate how the ransomware entered the company's servers
• DAttempt to isolate any compromised servers to prevent further damage

• A
  7% (2)
• B
  3% (1)
• C
  13% (4)
• D
  77% (23)

Explanation

When a ransomware attack is confirmed and the incident response team is activated, the immediate priority is containment - isolating compromised servers to prevent the ransomware from spreading laterally across the network. This follows the standard incident response lifecycle: Preparation → Identification → Containment → Eradication → Recovery → Lessons Learned. Updating antivirus (A) and restoring systems (B) come later in the eradication and recovery phases. Investigating the attack vector (C) is important but happens after containment so the investigation doesn't inadvertently spread the threat further.

No community discussion yet for this question.