Question

A security analyst has contained a ransomware outbreak by isolating infected hosts from the network. The malware's persistence mechanisms, dropped payloads, and compromised service accounts have been identified during analysis. The incident response team leader now asks what activity must be completed BEFORE systems are restored to production. Which action correctly represents the next phase of the incident response process?

Accepted Answer

Remove the malware, delete persistence mechanisms, and reset the compromised service account credentials across affected systems

Answer

Restore the affected systems from the most recent backups and monitor for reinfection

Answer

Convene the lessons-learned meeting to document root cause and improve controls

Answer

Re-isolate the hosts and capture additional volatile memory for forensic preservation