During an incident, some IoCs of possible ransomware contamination were found in a group of servers in a segment of the network. Which of the following steps should be taken next?

The correct answer is A. Isolation. Isolation is the first step to take after detecting some indicators of compromise (IoCs) of possible ransomware contamination. Isolation prevents the ransomware from spreading to other servers or segments of the network, and allows the security team to investigate and contain…

Submitted by andreas_gr· Mar 6, 2026Incident Response and Management

Question

Options

AIsolation
BRemediation
CReimaging
DPreservation

How the community answered

(33 responses)

A
76% (25)
B
3% (1)
C
15% (5)
D
6% (2)

Explanation

Isolation is the first step to take after detecting some indicators of compromise (IoCs) of possible ransomware contamination. Isolation prevents the ransomware from spreading to other servers or segments of the network, and allows the security team to investigate and contain the incident. Isolation can be done by disconnecting the infected servers from the network, blocking the malicious traffic, or applying firewall rules.

Topics

#Incident response#containment#ransomware#IoCs

Community Discussion

No community discussion yet for this question.

Full CS0-003 Practice