Ransomware has encrypted file servers in one network segment, and alerts show it is beginning to spread to systems in adjacent segments. What should the incident response team do FIRST?
Select an answer to reveal the explanation.
Short Explanation
When a fire's jumping between rooms, you close the fire doors before you start repainting. Segmentation is your fire door. Restoring now just hands the ransomware fresh files to encrypt.
Full Explanation
The priority while ransomware is actively spreading is to stop further damage. Restricting traffic between network segments, blocking the protocols and paths used for lateral movement, and isolating the infected segment confines the outbreak to systems already affected and protects the remaining environment. Containment of this kind is why segmentation is designed into networks in advance. Restoring encrypted servers from backups is a recovery step; doing it while the ransomware is still active risks re-encryption of the restored data and may expose the backups themselves. Paying the ransom does not stop malware that is already executing, provides no assurance that attackers will act as promised and is a business and legal decision for senior management with counsel, not an immediate containment action. Running antivirus scans while leaving connectivity unchanged allows spread to continue during the scans, and existing signatures already failed to prevent the infection. Exam caveat: containment decisions that interrupt business services should follow the authority defined in the incident response plan, but plans typically pre-authorize rapid isolation for active destructive malware. Operational check: confirm inter-segment rules are applied and verified, newly encrypted files stop appearing and backups are isolated and protected before recovery begins.