CS0-003 Incident Response and Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Running a full antivirus scan on the workstation

  Why it's wrong here

  Running a full antivirus scan on the workstation is primarily a detection and remediation step, not an immediate containment action for an active ransomware infection. While it might identify some malicious files, it is unlikely to stop an ongoing encryption process and could consume critical system resources, potentially accelerating the encryption or alerting the attacker to the detection, prompting further malicious actions or deletion of forensic artifacts. The primary goal in an active ransomware scenario is to prevent further spread, which scanning alone does not guarantee.

• ✗

  Disabling the user's Active Directory account

  Why it's wrong here

  Disabling the user's Active Directory account primarily restricts network access and authentication for that user. While it can prevent the user from logging into other systems or accessing network shares, it does not stop ransomware that has already executed on the local workstation from continuing its encryption process or attempting to spread laterally using existing local privileges or cached credentials. The ransomware's local operations are largely independent of the user's AD account status once execution has begun, making this an ineffective immediate containment strategy.

• ✗

  Rebuilding the workstation from a known good image

  Why it's wrong here

  Rebuilding a workstation from a known good image is a crucial step in the recovery phase of an incident response, aiming to restore the system to a clean state. However, it is not an immediate containment action. Attempting to rebuild a system while it is actively infected and potentially connected to the network risks further compromise or data loss, and it fails to address the immediate threat of the ransomware spreading to other systems. Containment must precede recovery to prevent wider impact and ensure the source of infection is isolated.

• ✓

  Disconnecting the workstation from the network

  Why this is correct

  Disconnecting the workstation from the network is the most immediate and effective short-term containment action for an active ransomware infection. This action physically isolates the compromised system, preventing the ransomware from communicating with command-and-control servers, exfiltrating data, or attempting to spread laterally to other network resources, shares, or systems. It buys critical time for incident responders to analyze the threat and plan further remediation steps without risking wider network compromise, thus limiting the overall impact of the incident.

Go deeper

Related to this question