Incident response · Question 11 of 12
An analyst discovers ransomware running on a server, currently encrypting files. What is the correct first step?
1 answer is correct. Hard
Show answer
Answer
- D Isolating the server from the network without switching it off
Explanation
Network isolation stops the spread to other systems and shares. If the server stays switched on, volatile traces in memory are preserved, which are important for analysis and sometimes even for decryption. Reinstalling before analysis destroys evidence.