Ransomware encrypts a public-works file share. Which sequence best reflects a complete incident management lifecycle response?
Select an answer to reveal the explanation.
Short Explanation
Ransomware is a full-play game, not a one-button restore. Detect, contain, report, recover, fix the root, then write down what you learned. Skipping lessons or tweeting mid-fire is how the next hit rhymes with the last.
Full Explanation
Incident management covers detection, response and mitigation, required reporting, recovery, remediation, and lessons learned. Omitting documentation, root-cause remediation, or lessons learned leaves the municipality exposed to repeat events. Social announcement before containment or undocumented ransom payments conflict with disciplined incident process.