The answer is to disconnect the workstation from the network. This is the correct first step in the containment phase because ransomware often uses network protocols like SMB or RDP to spread laterally to other systems, so isolating the machine immediately stops that propagation and prioritizes preventing further damage over remediation or analysis. On the ISC2 Certified in Cybersecurity CC exam, this question tests your understanding of the containment phase’s core goal: rapid action to limit scope, not investigation. A common trap is choosing “identify the ransomware variant” or “back up the files,” but those come later. Remember the memory tip: “Cut the cable before you label the malware”—network disconnection is always the first move in containment isolation.
ISC2 CC Security Operations Practice Question
This CC practice question tests your understanding of security operations. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A security operations center receives an alert that a workstation has been infected with ransomware. The infection is isolated to one machine. What is the first step in the containment phase of incident response?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "first"
Why it matters: Order matters here. You are being tested on which action comes before the others — not which action is generally useful.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disconnect the workstation from the network
The first step in the containment phase is to disconnect the workstation from the network. This immediately stops the ransomware from spreading laterally to other systems via SMB, RDP, or other network protocols. Containment prioritizes preventing further damage over remediation or analysis.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Restore the workstation from a recent backup
Why it's wrong here
Restoration is a recovery step after containment and eradication.
✓
Disconnect the workstation from the network
Why this is correct
Network isolation is the primary containment step to halt lateral movement.
Clue confirmation
The clue word "first" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Reboot the workstation in safe mode
Why it's wrong here
Rebooting may destroy volatile evidence and does not contain the spread if the network is still connected.
✗
Run a full antivirus scan
Why it's wrong here
Scanning is a remediation step, not immediate containment.
Common exam traps
Common exam trap: answer the scenario, not the keyword
ISC2 often tests the distinction between containment and eradication/recovery phases, and the trap here is that candidates mistake a recovery action (restore from backup) or a detection action (antivirus scan) for the first containment step.
Detailed technical explanation
How to think about this question
Disconnecting the network cable or disabling the network interface (e.g., via `ipconfig /release` or physically unplugging) immediately blocks outbound C2 traffic and lateral movement over TCP/UDP ports like 445 (SMB) or 3389 (RDP). In real-world incidents, ransomware often uses multiple propagation methods (e.g., PsExec, WMI), so network isolation is the only way to guarantee containment before any other action.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security team runs a vulnerability scan on a web application and discovers an unpatched SQL injection flaw. The team prioritises remediation by CVSS score — critical flaws are patched within 24 hours, high within 7 days. Questions like this test whether you understand vulnerability management processes, scanning tools, and remediation prioritisation.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this CC question in full detail.
Security Operations — This question tests Security Operations — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Disconnect the workstation from the network — The first step in the containment phase is to disconnect the workstation from the network. This immediately stops the ransomware from spreading laterally to other systems via SMB, RDP, or other network protocols. Containment prioritizes preventing further damage over remediation or analysis.
What should I do if I get this CC question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "first". Order matters here. You are being tested on which action comes before the others — not which action is generally useful.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security operations center (SOC) analyst receives an alert for a high volume of outbound traffic from an internal server to a known malicious IP address. Which step should the analyst take next?
medium
A.Shut down the server.
B.Disregard the alert as a false positive.
C.Block all outbound traffic from the server.
✓ D.Isolate the server from the network.
Why D: Isolating the server stops the suspicious traffic and prevents further data exfiltration or lateral movement while the incident is investigated. Other actions are either too broad or premature.
Variation 2. A security operations center (SOC) analyst receives an alert for a potential malware infection on a workstation. Which of the following is the first action the analyst should take?
easy
A.Reimage the workstation
B.Run a full antivirus scan
✓ C.Isolate the workstation from the network to prevent spread
D.Notify law enforcement
Why C: When a potential malware infection is detected, the immediate priority is containment to prevent lateral movement and further compromise. Isolating the workstation from the network (e.g., disabling the network interface or disconnecting the cable) stops the malware from communicating with command-and-control servers or spreading to other hosts. This aligns with the NIST incident response framework's containment phase, which precedes eradication and recovery actions.
Variation 3. You are a SOC analyst for a financial institution. At 2:00 AM, your SIEM generates a critical alert from the email security gateway indicating that an internal user received a phishing email with a malicious attachment. The email was delivered to the user's inbox, and the user's account activity logs show that the attachment was opened 10 minutes ago. The user is a junior accountant who works in the accounts payable department. You have access to endpoint detection tools, email logs, and network traffic data. The organization's incident response policy requires containment within 30 minutes of detection. Which action should you take FIRST?
medium
✓ A.Isolate the user's workstation from the network to prevent lateral movement.
B.Scan the user's workstation with antivirus software.
C.Block the sender's email address at the email gateway.
D.Send an email to the user instructing them to delete the email.
Why A: The incident response policy requires containment within 30 minutes. Isolating the workstation (e.g., via network access control or disabling the switch port) immediately stops any ongoing malicious activity, such as command-and-control communication or lateral movement, which is the highest priority after detection. This aligns with the NIST SP 800-61 containment strategy and the SANS PICERL model, where containment precedes eradication and recovery.
Variation 4. Refer to the exhibit. The IDS alert indicates a possible SpyEye botnet check-in from an internal host. What immediate action should the analyst take?
hard
✓ A.Isolate the internal host from the network
B.Ignore the alert as it is a false positive
C.Block the destination IP at the firewall
D.Run a full antivirus scan on the internal host
Why A: Isolating the internal host immediately stops the potential command-and-control (C2) communication with the SpyEye botnet, preventing data exfiltration or further compromise. This is the first step in incident response (containment) before any forensic analysis or remediation, as per NIST SP 800-61 guidelines. Delaying containment could allow the botnet to receive new instructions or spread laterally.
Last reviewed: Jun 30, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.