200-201 Question 351
Select 4You are a cybersecurity analyst responding to a ransomware attack on a company's file server. The attacker has encrypted critical business files and left a ransom note demanding payment in cryptocurrency. What are the most appropriate steps to take as part of the containment, eradication, and recovery process?
- A
Isolate the infected server from the network to prevent further spread.
- B
Pay the ransom immediately to recover the encrypted files.
- C
Analyze the ransomware sample to identify its behavior and potential vulnerabilities.
- D
Restore the affected files from a known good backup after ensuring the malware is removed.
- E
Monitor the network for unusual activity to identify any lingering threats.
Show answer and explanation
Correct answers: A, C, D, E
Explanation
In a ransomware incident, containment, eradication, and recovery are key steps. Isolating the infected system prevents further damage. Analyzing the malware provides insight into its operation, which guides eradication efforts. Restoring from clean backups ensures that the organization can recover without relying on the attacker. Finally, monitoring the network during recovery is vital to ensure the attack has been fully mitigated and no secondary attacks occur. Paying the ransom is not a recommended practice as it may perpetuate the problem and does not guarantee recovery.
- A. Correct.
Isolating the infected server is a critical containment step to prevent the ransomware from spreading to other systems.
- B. Incorrect.
Paying the ransom is not recommended as it does not guarantee file recovery and may encourage further attacks.
- C. Correct.
Analyzing the ransomware helps understand its behavior, confirm that it has been eradicated, and develop preventive measures.
- D. Correct.
Restoring from a known good backup ensures that the organization can recover its files after completely removing the malware.
- E. Correct.
Monitoring the network is essential during recovery to detect any residual threats or signs of reinfection.