CS0-003: CompTIA Cybersecurity Analyst (CySA+)

By CompTIA · Question Mode

QuestionQ38

Incident Response and Management

During an incident, indicators of compromise (IoCs) suggesting possible ransomware contamination are discovered on a group of servers within a network segment. Which of the following action should be taken next?

Explanation

Isolation is the immediate containment action for suspected ransomware. It limits communication and lateral spread while the incident can be investigated and subsequent remediation or recovery actions are planned.

Community Discussion

No comments yet. Be the first to start the discussion!