Question

A security team has finished eradicating a ransomware infection across the affected file servers. Systems have been rebuilt from known-good images, patched, and reconnected to the production network. The incident commander now wants to formally complete the recovery phase before transitioning to lessons learned. Which action is MOST important to perform during this recovery phase?

Accepted Answer

Validate that restored systems are functioning normally and increase monitoring to confirm the threat has not returned

Answer

Draft the final incident report and schedule the post-incident review meeting with stakeholders

Answer

Isolate the affected servers from the network to prevent further encryption of shared files

Answer

Wipe the malware artifacts and terminate the malicious processes on the rebuilt servers