A security administrator notices that multiple user workstations are infected with the same strain of ransomware. The administrator isolates the infected systems from the network. Which of the following should the administrator do NEXT according to incident response procedures?

Restore operations from backups

Restoration comes after eradication and verification that the infection is fully removed; doing it too early could re-infect the network.

Notify law enforcement

Notifying law enforcement may be required by policy or law, but it is not the immediate next step after isolation.

Conduct a root cause analysis

Root cause analysis is part of the lessons learned phase, which occurs after the incident has been contained and eradicated.

What does this 220-1101 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Identify the source of the infection — After isolating (containing) the infected systems, the next step is to identify the source of the infection. This involves analyzing logs, user activity, and attack vectors to understand how the ransomware entered the network. Identifying the source is critical to prevent further spread and to determine the appropriate eradication strategy. Restoring operations, notifying law enforcement, and conducting root cause analysis come later in the process.

What should I do if I get this 220-1101 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.