300-215 Question 208
Single answerDuring an incident response process, an organization detects a ransomware attack targeting their systems. What is the primary goal of the incident response team at this stage of the attack?
- A
Eradicate the ransomware and restore systems to operational status
- B
Contain the ransomware to prevent further spread and damage
- C
Identify the attacker and gather evidence for legal action
- D
Implement new security controls to prevent future attacks
Show answer and explanation
Correct answer: B
Explanation
The primary goal of incident response during an active attack, such as a ransomware infection, is to contain the threat. Containment minimizes the scope and impact of the attack, ensuring that further systems are not compromised while the incident response team works on eradication, recovery, and other steps.
- A. Incorrect.
Eradication and restoration are important steps in the incident response process but are not the immediate priority during the detection of an active attack. Containing the threat takes precedence to minimize damage.
- B. Correct.
Containing the ransomware is the most critical immediate goal at this stage. It prevents the attack from spreading further and causing additional harm to the organization.
- C. Incorrect.
Identifying the attacker and gathering evidence is part of the forensic analysis process, but it is not the primary goal during the containment phase of incident response.
- D. Incorrect.
Implementing new security controls is part of the post-incident recovery and lessons-learned phase. It is not the immediate goal when responding to an active incident.