100-160 Question 255
Single answerAn organization experiences a ransomware attack that locks critical business files. The security team begins responding by identifying the affected systems and isolating them from the network. What should their next step be according to standard cybersecurity incident response procedures?
- A
Eradicate the ransomware by removing malicious files and restoring data from backups.
- B
Document the incident thoroughly and prepare a lessons-learned report.
- C
Analyze the attack to determine its scope and collect evidence for further investigation.
- D
Notify stakeholders and law enforcement about the ransomware attack.
Show answer and explanation
Correct answer: C
Explanation
The cybersecurity incident response process generally follows a structured approach: preparation, identification, containment, analysis, eradication, recovery, and post-incident activities. After isolating affected systems, the next logical step is to analyze the incident. This analysis helps determine the scope of the attack, its root cause, and the necessary actions to contain and eradicate the threat effectively.
- A. Incorrect.
This step, while necessary, comes later in the incident response process. Eradication is performed after the analysis phase to ensure that all malicious elements are identified and properly handled.
- B. Incorrect.
Documenting the incident and preparing a lessons-learned report is part of the post-incident phase, which occurs after the incident has been contained, eradicated, and recovered.
- C. Correct.
Analyzing the attack is the next step after isolating affected systems. This involves determining the scope of the attack, identifying its root cause, and collecting evidence for both remediation efforts and potential legal action.
- D. Incorrect.
Notifying stakeholders and law enforcement is important but usually occurs after the analysis phase when the full details and impact of the attack are understood.