First Step in Ransomware Incident: Isolate and Preserve
A file server suddenly shows many encrypted files with a new extension, and endpoint tools report that Volume Shadow Copy Service was disabled minutes earlier. A note on the desktop demands payment in cryptocurrency. What should the security team do first?
Quick Answer
The correct first step in a ransomware first response is to isolate the affected systems from the network and preserve evidence. This action immediately stops the ransomware from spreading laterally via SMB or other network protocols, which is critical because the attacker has already disabled Volume Shadow Copy Service to block file recovery. On the Security+ SY0-701 exam, this scenario tests your understanding of incident response procedures—specifically the containment phase before eradication or recovery. A common trap is jumping to remediation, like running antivirus or restoring from backup, but the exam emphasizes that containment and evidence preservation must come first to maintain forensic integrity. Remember the mnemonic “ICE” for Incident response: Isolate, Contain, then Examine—never skip to the E before the I.
⚠ Common exam trap
A common mix-up: candidates confuse 'immediate remediation' (e.g., reimaging) with 'first response' (containment and evidence preservation), or they may incorrectly assume paying the ransom is a viable technical solution, when in fact it is never recommended in incident response frameworks like NIST SP 800-61.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the affected systems from the network and preserve evidence.
Isolating the affected systems from the network and preserving evidence is the correct first step because it prevents the ransomware from spreading to other systems via SMB or other network protocols, and it preserves the forensic artifacts (e.g., the ransom note, encrypted files, and Volume Shadow Copy Service logs) needed for incident response and potential decryption. Disabling VSS is a common ransomware tactic to prevent file recovery, so immediate containment is critical before any remediation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Pay the ransom immediately to restore access quickly.
Why it's wrong here
Paying the ransom is risky, does not guarantee recovery, and can fund further criminal activity.
- ✓
Isolate the affected systems from the network and preserve evidence.
Why this is correct
Isolation is the first priority because it helps stop the spread of ransomware and prevents additional encryption or lateral movement. Preserving evidence at the same time supports later incident response, forensics, and potential legal or insurance needs. The organization can then assess the scope, validate backups, and begin containment and recovery in a controlled way. Immediate disconnection from the network is usually more valuable than attempting remediation on a live, actively infected host.
- ✗
Reimage the server immediately without documenting the event.
Why it's wrong here
Reimaging may eventually be necessary, but doing it immediately destroys evidence and can interfere with proper incident handling.
- ✗
Disable antivirus alerts so staff can work without distractions.
Why it's wrong here
Suppressing alerts hides the incident and prevents the security team from seeing whether the malware is still active elsewhere.
Go deeper
Related to this question
Learn chapter
Network-Based Attacks
Key term
SMB
SMB is a network file-sharing protocol that allows applications to read, write, and request services from server programs in a computer network.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A file server suddenly shows renamed files with a new extension, users see a ransom note demanding cryptocurrency, and shadow copies are deleted from the host. Which malware family is the best match?
medium- ✓ A.Ransomware, because the attacker is encrypting data and demanding payment to restore access.
- B.Trojan, because the attack requires a disguised program to install itself.
- C.Spyware, because the attacker is likely trying to monitor file activity.
- D.Logic bomb, because the malware likely triggered after a specific condition was met.
Why A: Ransomware is the correct classification because the scenario describes file encryption (renamed files with new extensions), a ransom note demanding cryptocurrency, and the deletion of shadow copies (Volume Shadow Copy Service snapshots) to prevent file recovery. These are hallmark behaviors of ransomware, specifically crypto-ransomware, which encrypts data and demands payment for decryption keys.
Variation 2. A user says their files suddenly have a new extension and a note appears demanding payment to restore access. Which type of malware is most likely involved?
easy- ✓ A.Ransomware
- B.Adware
- C.Spam filter
- D.Screen saver
Why A: Ransomware is the correct answer because it specifically encrypts files and appends a new extension, then displays a ransom note demanding payment for decryption. This matches the user's description of files becoming inaccessible with a new extension and a payment demand.
Variation 3. A laptop user reports that many files now have strange extensions, a ransom note appears on the desktop, and the files cannot be opened. Which malware is most likely responsible?
easy- A.Spyware
- ✓ B.Ransomware
- C.Rootkit
- D.Worm
Why B: Ransomware is the correct answer because it encrypts the user's files, appends a new extension (e.g., .encrypted or .locked), and displays a ransom note demanding payment for the decryption key. The symptoms of inaccessible files with altered extensions and a visible ransom note are the classic indicators of a ransomware infection, such as those caused by CryptoLocker or LockBit.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.