During an incident response engagement, the IR team is called at 11 PM after a ransomware alert fires on a file server. The server is actively encrypting shares. What is the correct sequence of initial containment actions?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — isolate the file server from the network first to stop ransomware from spreading while keeping the system state intact for forensics. You should preserve volatile memory if possible because RAM may hold encryption keys or attacker artifacts. Document the state before taking further action.
Full Explanation
Isolate the server from the network (disconnect or VLAN quarantine) to stop encryption spread to other hosts, preserve volatile memory if possible, then document the state before any further action. Network isolation stops lateral spread, the primary risk during active encryption, while preserving system state for forensics; volatile memory may contain encryption keys or attacker artifacts. Powering off immediately is wrong because it risks corrupting evidence and loses volatile memory. Restoring from backup immediately is wrong because restoration before containment risks the backup target being encrypted or overwritten. Waiting for executive approval is wrong because active encryption causes additional damage.