Ransomware encrypts a public-works file share. Which sequence best reflects a complete incident management lifecycle response?
Select an answer to reveal the explanation.
Short Explanation
Ransomware is a full-play game, not a one-button restore. Detect, contain, report, recover, fix the root, then write down what you learned. Skipping lessons or tweeting mid-fire is how the next hit rhymes with the last.
Full Explanation
A ransomware event against municipal systems demands a lifecycle response: detect the activity, respond and mitigate to contain spread, report as required by law and policy, recover services from known-good backups or rebuilt systems, remediate root causes such as exposed RDP or unpatched flaws, and capture lessons learned so playbooks and controls improve. Skipping any phase leaves the city vulnerable to recurrence or to regulatory and public-trust failures. Detection and containment protect remaining systems; reporting meets transparency and legal duties; recovery restores citizen services; remediation and lessons close the loop. Coordination across IT, legal, communications, and executive leadership is part of the operating model, not an afterthought.
Only restoring from backup and skipping lessons-learned leaves the entry path open for the next incident. Paying the ransom quietly and never documenting detection or containment steps may violate policy, funding rules, or law, and forfeits organizational learning while encouraging repeat targeting. Announcing victory on social media before containment begins can tip adversaries, panic constituents, and lock leadership into inaccurate statements. Exam caveat: payment decisions are legal/executive calls—CISSP emphasizes process completeness over any single tactic. Operationally, exercise the ransomware playbook with tabletop and restore tests, pre-draft notification decision trees, and require a post-incident report with assigned remediation owners and due dates.