Which of the following should be the FIRST step in recovering from a ransomware attack?

The correct answer is C. Isolating the affected systems. The first step in recovering from a ransomware attack is to isolate the affected systems. This prevents the ransomware from spreading to other systems and causing further damage, allowing for containment of the incident before proceeding with recovery efforts such as restoring…

Submitted by fatema_kw· Apr 18, 2026Information Security Incident Management

Question

Options

AAlerting the authorities
BPaying the ransom
CIsolating the affected systems
DRestoring from backup

How the community answered

(38 responses)

A
3% (1)
B
8% (3)
C
84% (32)
D
5% (2)

Explanation

The first step in recovering from a ransomware attack is to isolate the affected systems. This prevents the ransomware from spreading to other systems and causing further damage, allowing for containment of the incident before proceeding with recovery efforts such as restoring from

Topics

#Ransomware#Incident Response#Containment#Recovery Steps

Community Discussion

No community discussion yet for this question.

Full CISM Practice