A security technician has confirmed that a user's workstation is infected with ransomware that has encrypted local files. The technician immediately isolated the system by disconnecting the network cable and then created a forensic image of the hard drive for evidence. According to standard incident response procedures, what should the technician do NEXT?

Report the incident to management and legal

While reporting is necessary, it should be done after the immediate threat is contained and eradication has begun or been completed. The priority after containment and evidence is to remove the malware.

Restore user data from the most recent backup

Restoring from backup is part of the recovery phase, which occurs after the malware has been completely removed (eradication). Restoring before eradication could reintroduce the ransomware.

Identify the root cause of the ransomware infection

Root cause analysis is a critical step, but it typically takes place after recovery during the 'lessons learned' phase. The immediate next step after containment and evidence is to eradicate the malware from the affected system.

What does this 220-1101 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Remove the ransomware from the workstation — After containment and evidence preservation (forensic imaging), the next phase in the incident response process is eradication. The technician must remove the ransomware and any associated malware from the system to prevent further damage or reinfection. Eradication typically involves using antivirus tools to clean the system or, if necessary, wiping the drive and reinstalling the operating system. Reporting to management, restoring from backups, or identifying the root cause are all important steps, but they occur later in the process. Specifically: reporting is often done after initial containment or after eradication; restoration (recovery) comes after eradication; and root cause identification is part of the lessons learned phase after recovery is complete.

What should I do if I get this 220-1101 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.