Which of the following techniques should be applied FIRST to limit the impact of a malware incident?

The correct answer is A. Isolate the systems. Isolation (containment) is always the first response action during a malware incident because it immediately stops the malware from propagating to additional systems and limits the blast radius. Shutting down systems (B) could destroy volatile memory evidence and may be…

Submitted by tyler.j· Apr 18, 2026Information Security Incident Management

Question

Options

AIsolate the systems.
BShut down the systems.
CRestore data from a backup.
DCreate a forensic image.

How the community answered

(35 responses)

A
83% (29)
B
3% (1)
C
9% (3)
D
6% (2)

Explanation

Isolation (containment) is always the first response action during a malware incident because it immediately stops the malware from propagating to additional systems and limits the blast radius. Shutting down systems (B) could destroy volatile memory evidence and may be unnecessary. Restoring from backup (C) is a recovery-phase action that cannot begin until containment is achieved. Creating a forensic image (D) supports investigation and is important, but imaging an uncontained system allows the malware to continue spreading while you work - containment must come first.

Topics

#Incident Response#Malware Incident#Containment Strategy#System Isolation

Community Discussion

No community discussion yet for this question.

Full CISM Practice