During an incident response engagement, the IR team is called at 11 PM after a ransomware alert fires on a file server. The server is actively encrypting shares. What is the correct sequence of initial containment actions?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — b is correct because network isolation stops lateral spread (the primary risk during active encryption) while preserving the system state for forensics; volatile memory (RAM) may contain encryption keys or attacker artifacts. A is wrong because hard power-off risks corrupting evidence and loses volatile memory; isolation is preferred.
Full Explanation
B is correct because network isolation stops lateral spread (the primary risk during active encryption) while preserving the system state for forensics; volatile memory (RAM) may contain encryption keys or attacker artifacts. A is wrong because hard power-off risks corrupting evidence and loses volatile memory; isolation is preferred. C is wrong because restoration before containment risks the backup target being encrypted or overwritten. D is wrong because waiting for executive approval during active encryption allows significant additional damage.