Incident Management →mediumMultiple ChoiceObjective-mapped

CISM Incident Management Practice Question

An organization's incident response team has contained a ransomware incident. What is the NEXT step according to the incident management program?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Eradicate the malware and restore systems

After containment, the next priority is eradication of the threat to remove all traces of the malware and restore systems securely.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Eradicate the malware and restore systems
Why this is correct
Eradication and recovery follow containment in the incident response lifecycle.
✗
Perform root cause analysis
Why it's wrong here
Root cause analysis is typically done post-incident, not before eradication.
✗
Conduct a lessons learned meeting
Why it's wrong here
Lessons learned occurs after recovery and closure.
✗
Notify regulatory authorities
Why it's wrong here
Notification may be required but is not the immediate next step after containment.

Go deeper