Question

A ransomware incident has been contained: affected hosts are isolated on a quarantine VLAN, and the C2 domains are blocked at the perimeter. The IR lead wants to move from containment to eradication. Before the team begins eradication activities, which action is MOST important to complete first?

Accepted Answer

Confirm that all systems affected by the incident have been fully identified and scoped

Answer

Restore encrypted files from the most recent backups to the isolated hosts

Answer

Reconnect the quarantined hosts to the production network to test business functionality

Answer

Draft the lessons-learned report summarizing the timeline of the incident