An organization shut down its system during a cyberattack. When the system was brought back online, the organization's data was then encrypted by ransomware. Which of the following is the MOST likely

The correct answer is D. The containment response to the attack failed.. If ransomware encrypted data after the system was brought back online, it indicates the threat was not fully contained or eradicated before restoration (e.g., persistence mechanisms or infected hosts remained). This points to a failure in the containment response.

Submitted by daniela_cl· Apr 18, 2026Information Security Incident Management

Question

An organization shut down its system during a cyberattack. When the system was brought back online, the organization's data was then encrypted by ransomware. Which of the following is the MOST likely cause of the successful ransomware installation?

Options

AThe organization did not have a patching and vulnerability management program.
BThe firewall was not properly configured to prevent the attack.
CThe system lacked the necessary encryption and security measures.
DThe containment response to the attack failed.

How the community answered

(32 responses)

A
6% (2)
B
19% (6)
C
9% (3)
D
66% (21)

Explanation

If ransomware encrypted data after the system was brought back online, it indicates the threat was not fully contained or eradicated before restoration (e.g., persistence mechanisms or infected hosts remained). This points to a failure in the containment response.

Topics

#Ransomware#Incident response#Containment failure#System remediation

Community Discussion

No community discussion yet for this question.

Full CISM Practice