CS0-003 Practice Question: Has identified a ransomware outbreak on several…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Pay the ransom to recover data quickly.

  Why it's wrong here

  Paying the ransom provides no technical guarantee that the attacker will supply a working decryption key, and even if a key is delivered, it may only partially restore files, leaving some data permanently lost. Furthermore, it funds the criminal infrastructure and may mark the organization as a willing target for future extortion, and in many jurisdictions paying ransom to sanctioned entities can carry legal penalties. This action should never be the immediate response during an active outbreak.

• ✓

  Disconnect all network shares to prevent encryption.

  Why this is correct

  Disconnecting all network shares is a critical containment step because modern ransomware actively scans for mapped drives and open SMB shares, which it can encrypt just like local disks after compromising a single endpoint. By severing access to shared folders, you eliminate a large portion of the attack surface and prevent the ransomware from quickly encrypting centralized file servers and backup repositories. This action directly limits the blast radius while you deploy more comprehensive containment measures.

• ✗

  Contact law enforcement for guidance.

  Why it's wrong here

  Contacting law enforcement is an important post-incident step for notification and legal compliance, but it does not provide the immediate, granular technical guidance needed to halt an ongoing ransomware encryption spree. Law enforcement agencies typically do not offer real-time response capabilities, and by the time they respond, the malware may have already propagated across the network. Therefore, this action should be deferred until after the network shares are disconnected and affected workstations are isolated.

• ✗

  Reimage all affected systems immediately.

  Why it's wrong here

  Reimaging affected systems immediately is counterproductive because it destroys volatile and non-volatile forensic evidence, including the ransomware binary, artifacts of the initial infection vector, and any indicators of compromise that could be used to identify other affected hosts. Without a forensic image or memory dump, the security team may fail to discover the root cause, allowing the same vulnerability to be re-exploited after reimaging. Reimaging should only be performed after thorough evidence collection and when the system is ready for secure restoration.

• ✓

  Isolate the affected workstations from the network.

  Why this is correct

  Isolating affected workstations from the network is an essential immediate response because it stops the ransomware from using the local network as a propagation channel via SMB, WMI, or other lateral movement techniques. Disabling the network interface or moving the host to a quarantine VLAN prevents further encryption of remote hosts and shared resources, while still preserving the system's memory and disk contents for analysis. This action buys time for the incident response team to scope the outbreak and implement defensive measures.

Go deeper

Related to this question