Question

An analyst has fully contained a ransomware incident affecting several file servers. Malware artifacts and attacker persistence mechanisms have been identified and documented, and forensic images have been collected. The incident commander now asks what the team should do NEXT before allowing users to reconnect to the restored file servers. Which action best represents the correct next step in the incident response lifecycle?

Accepted Answer

Remove all identified malware, malicious accounts, and persistence mechanisms from the affected systems and verify the environment is clean

Answer

Restore data from backups to production and immediately return the servers to normal user access to minimize downtime

Answer

Convene the lessons-learned meeting to document root cause and update the ransomware playbook

Answer

Draft the final incident report and notify regulators of the confirmed breach