CAS-004 Practice Question: Drag and drop the steps to respond to a…

Drag and drop the steps to respond to a ransomware incident in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Isolate, Identify, Contain, Eradicate, Recover

Incident response follows NIST framework: isolate, identify, contain, eradicate, recover.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Isolate, Identify, Contain, Eradicate, Recover
Why this is correct
This order follows the NIST incident response framework adapted for ransomware: first isolate affected systems to prevent further damage, then identify the ransomware variant, contain the spread, eradicate the ransomware from all systems, and finally recover data from backups.
✗
Identify, Isolate, Contain, Eradicate, Recover
Why it's wrong here
This order is incorrect because identifying the ransomware before isolating the infected systems can allow the ransomware to spread further, increasing damage. Isolation must be the first step in ransomware response.
✗
Isolate, Contain, Identify, Eradicate, Recover
Why it's wrong here
This order is incorrect because containment before identification can lead to ineffective containment measures. You must first identify the ransomware variant to understand its behavior and then apply appropriate containment steps.
✗
Isolate, Identify, Eradicate, Contain, Recover
Why it's wrong here
This order is incorrect because eradication before containment can leave residual infection in other parts of the network. Proper containment measures must be in place before eradication to prevent reinfection.

Go deeper