100-160 Question 256
Select 3During a cybersecurity incident, your organization experienced a ransomware attack that encrypted critical files. As part of the cybersecurity incident response process, which of the following actions should be prioritized to properly handle the situation?
- A
Isolate the affected systems from the network to prevent further spread.
- B
Immediately pay the ransom to recover encrypted files and restore operations.
- C
Notify the organization's incident response team and begin documentation of the incident.
- D
Analyze logs and other data to identify the source and scope of the attack.
- E
Ignore the incident if backups are available and proceed with restoring the data.
Show answer and explanation
Correct answers: A, C, D
Explanation
The correct actions during a ransomware incident involve isolating affected systems, notifying the incident response team, documenting the incident, and analyzing data to determine the source and scope of the attack. These steps are part of a comprehensive incident response process aimed at containment, eradication, and recovery while ensuring lessons are learned for future prevention.
- A. Correct.
Isolating the affected systems is critical to prevent the ransomware from spreading to other devices or systems in the network.
- B. Incorrect.
Paying the ransom is not recommended, as it encourages attackers and does not guarantee the recovery of encrypted files.
- C. Correct.
Notifying the incident response team and documenting the incident are essential steps in ensuring a coordinated and thorough response to the attack.
- D. Correct.
Analyzing logs and other data helps in identifying how the attack occurred, its scope, and how to prevent similar incidents in the future.
- E. Incorrect.
Ignoring the incident, even if backups are available, is not a proper response. Incident response procedures must still be followed to assess and mitigate any lingering risks.