200-201 Question 352
Select 4You are a cybersecurity analyst responding to a ransomware attack on a company’s network. After isolating the infected systems, what are the next appropriate steps during the containment, eradication, and recovery process?
- A
Identify and disconnect any additional compromised systems from the network.
- B
Pay the ransom to regain access to encrypted files as quickly as possible.
- C
Perform a full forensic analysis to identify the root cause of the attack.
- D
Restore affected systems from clean, verified backups.
- E
Implement patches and security updates to address any vulnerabilities exploited in the attack.
Show answer and explanation
Correct answers: A, C, D, E
Explanation
During a ransomware attack, containment involves isolating infected systems to stop the spread of the malware. Eradication requires identifying the root cause, addressing vulnerabilities, and removing the malware. Recovery includes restoring systems from clean backups to resume normal operations. Paying the ransom is not part of a recommended response as it does not guarantee resolution and may lead to additional risks.
- A. Correct.
Identifying and disconnecting additional compromised systems is critical to preventing further spread of the ransomware.
- B. Incorrect.
Paying the ransom is not recommended as it does not guarantee the recovery of files and may encourage future attacks.
- C. Correct.
Performing a forensic analysis helps in understanding how the attack occurred and prevents similar incidents in the future.
- D. Correct.
Restoring systems from clean, verified backups is an essential recovery step to ensure business continuity and eliminate the infection.
- E. Correct.
Implementing patches and security updates addresses vulnerabilities exploited by the attackers, reducing the risk of recurrence.