Question

During an active ransomware incident, the IR team has isolated three infected file servers from the network to stop encryption from spreading. Business leadership demands that critical shared drives be restored within hours to continue operations, but the team has not yet determined how the malware entered the environment. Which containment approach should the IR team implement next to balance operational needs with the ongoing investigation?

Accepted Answer

Implement long-term containment by rebuilding clean systems in an isolated segment and restoring validated backups while forensic analysis of the original systems continues

Answer

Move directly to eradication by reimaging all three servers so operations can resume as quickly as possible

Answer

Remove the network isolation on the infected servers so users can access the shared drives while monitoring continues

Answer

Declare the incident recovered and return the original isolated servers to production after running an antivirus scan