300-215 Question 113
Select 2During an active ransomware attack in your organization, you are tasked with conducting an initial triage and containment using Cisco Secure Endpoint. Which of the following actions should you prioritize to mitigate the threat effectively?
- A
Isolate the infected endpoints from the network using Cisco Secure Endpoint's containment feature.
- B
Run a full malware scan on the infected endpoints using Cisco Secure Endpoint.
- C
Reboot the infected endpoints to terminate the ransomware process.
- D
Identify and block the command-and-control (C2) traffic using Cisco Secure Firewall and Secure Network Analytics.
- E
Restore the infected systems from the most recent backups.
Show answer and explanation
Correct answers: A, D
Explanation
In an active ransomware incident, the immediate priorities are containment and mitigation. Isolating infected endpoints prevents further spread of the ransomware, while blocking C2 traffic disrupts the attack's ability to communicate with its operators. These actions are essential to limit the impact and buy time for further investigation and remediation.
- A. Correct.
Isolating infected endpoints is crucial to prevent the ransomware from spreading laterally across the network. Cisco Secure Endpoint provides this functionality to quickly contain the threat.
- B. Incorrect.
Running a full malware scan is a good practice but not a priority during an active ransomware attack. Containment and stopping the spread should take precedence.
- C. Incorrect.
Rebooting the infected endpoints can potentially worsen the situation by triggering additional malicious behavior, such as file encryption or further propagation.
- D. Correct.
Blocking command-and-control (C2) traffic helps disrupt communication between the ransomware and its operators, reducing the attack's effectiveness. Cisco Secure Firewall and Secure Network Analytics are vital tools for this purpose.
- E. Incorrect.
Restoring systems from backups is a recovery step that should occur after containment and eradication, not during the initial response to an active attack.