During an incident response engagement, the IR team is called at 11 PM after a ransomware alert fires on a file server. The server is actively encrypting shares. What is the correct sequence of initial containment actions?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because network isolation stops lateral spread (the primary risk during active encryption) while preserving the system state for forensics; volatile memory (RAM) may contain encryption keys or attacker artifacts. A is wrong because hard power-off risks corrupting evidence and loses volatile memory; isolation is preferred.
Full explanation below image
Full Explanation
B is correct because network isolation stops lateral spread (the primary risk during active encryption) while preserving the system state for forensics; volatile memory (RAM) may contain encryption keys or attacker artifacts. A is wrong because hard power-off risks corrupting evidence and loses volatile memory; isolation is preferred. C is wrong because restoration before containment risks the backup target being encrypted or overwritten. D is wrong because waiting for executive approval during active encryption allows significant additional damage.