mediumMultiple ChoiceObjective-mapped
Evidence Preservation: Next Step After Isolating Ransomware
During a ransomware incident, the incident response team identifies that the encryption process is still ongoing. The CISO decides to isolate affected systems to prevent further spread. Which of the following is the MOST appropriate next step?
Quick Answer
The correct answer is to preserve forensic evidence before taking any recovery actions. This is because during an ongoing ransomware incident, volatile data such as encryption keys in memory, active process artifacts, and live network connections can be destroyed if recovery steps like disconnecting cables or restoring backups are taken prematurely. Evidence preservation in incident response ensures that critical forensic data is captured to identify the ransomware variant, understand the attack vector, and support legal proceedings. On the Certified Information Security Manager CISM exam, this question tests your understanding of the incident response lifecycle, specifically the priority of containment versus investigation. A common trap is assuming that immediate disconnection or recovery is the next step after isolation, but the CISM framework emphasizes that forensic integrity must come first to avoid destroying evidence. Remember the mnemonic "ICE" — Isolate, Capture Evidence, then Eradicate.
⚠ Common exam trap
Many candidates confuse immediate containment (disconnecting cables) with the forensic imperative to preserve volatile evidence, leading them to choose Option A, but CISM emphasizes that evidence preservation takes precedence over hasty recovery actions during an active incident.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Preserve forensic evidence before taking any recovery actions.
Preserving forensic evidence is critical before any recovery actions, especially during an ongoing ransomware incident. The encryption process may still be active, and taking immediate recovery steps (like disconnecting cables or restoring backups) could destroy volatile data (e.g., encryption keys in memory, process artifacts, network connections) that are essential for understanding the attack vector, identifying the ransomware variant, and supporting legal or law enforcement actions. The CISO's decision to isolate systems helps contain the spread, but the next priority must be evidence preservation to ensure a thorough investigation and potential prosecution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disconnect all network cables to stop the encryption.
Why it's wrong here
While isolation is important, preserving evidence should come first if possible.
- ✗
Contact law enforcement before any internal actions.
Why it's wrong here
Initial containment and evidence preservation should precede external notification.
- ✗
Restore systems from the most recent backup immediately.
Why it's wrong here
Restoring without preserving evidence may destroy forensic data and hinder investigation.
- ✓
Preserve forensic evidence before taking any recovery actions.
Why this is correct
Preserving evidence ensures that the incident can be investigated properly.
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CISM
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. During an incident, the incident response team needs to preserve evidence for legal proceedings. Which of the following is the MOST important action to take?
easy- ✓ A.Create a forensic image of affected systems using write-blockers.
- B.Document the incident in a free-form text.
- C.Take screenshots of system logs.
- D.Notify law enforcement immediately.
Why A: Creating a forensic image of affected systems using write-blockers is the most important action because it preserves the original data in a bit-for-bit, unaltered state, ensuring the evidence is admissible in legal proceedings. Write-blockers prevent any write operations to the source drive, maintaining the integrity of the evidence chain of custody. Without a forensically sound image, any subsequent analysis could be challenged as tampered or unreliable.
Variation 2. During incident investigation, which evidence preservation method is most important?
easy- A.Take screenshots of the attack
- B.Interview witnesses immediately
- ✓ C.Create a forensic image of affected drives
- D.Reboot the system to capture memory
Why C: Creating a forensic image of affected drives (option C) is the most important evidence preservation method because it captures a bit-for-bit copy of the storage media, including deleted files, slack space, and unallocated clusters, without altering the original evidence. This ensures data integrity and admissibility in legal proceedings, as the image can be hashed (e.g., using SHA-256) and verified against the original. In incident response, the order of volatility dictates that persistent storage is preserved after volatile memory, but for long-term analysis, the forensic image is the gold standard.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.