Question

During a ransomware outbreak, an incident responder discovers several infected servers actively encrypting shared storage. Management wants the systems isolated immediately, but the legal team has indicated the organization may pursue prosecution and file a cyber-insurance claim. What should the incident responder do FIRST to balance containment with these requirements?

Accepted Answer

Isolate the infected systems from the network while capturing volatile data and memory images before altering their state

Answer

Power off all infected servers to halt encryption as quickly as possible

Answer

Restore the affected servers from the most recent backup to resume operations

Answer

Reimage the infected servers immediately to eradicate the ransomware