The correct next step after system isolation is to preserve forensic evidence from the isolated systems. This step is critical because ransomware incidents leave behind volatile data—such as memory dumps, logs, and encrypted files—that must be captured intact before any remediation actions like wiping or rebuilding occur. Destroying or altering this evidence would prevent the incident response team from analyzing the attack vector, identifying the ransomware variant, and potentially recovering data without paying the ransom. On the ISC2 Certified in Cybersecurity CC exam, this question tests your understanding of the incident response process, specifically the order of operations in the “containment, eradication, and recovery” phase. A common trap is to jump straight to eradication or system restoration, but the exam emphasizes that forensic preservation must happen immediately after isolation to support legal and investigative requirements. Memory tip: think “Isolate, then Investigate”—never wipe before you capture.
ISC2 CC Business Continuity, DR & Incident Response Practice Question
This CC practice question tests your understanding of business continuity, dr & incident response. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
During a ransomware incident, the incident response team isolates affected systems. Which of the following is the NEXT best step?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "best"
Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Preserve forensic evidence from the isolated systems.
After isolating affected systems during a ransomware incident, the next best step is to preserve forensic evidence from those systems. This ensures that data such as memory dumps, logs, and encrypted files are captured intact for analysis, which is critical for understanding the attack vector, identifying the ransomware variant, and potentially recovering data without paying the ransom. Forensic preservation must occur before any remediation steps like wiping or rebuilding, as those actions would destroy the evidence needed for investigation and legal proceedings.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Preserve forensic evidence from the isolated systems.
Why this is correct
Preserving evidence supports investigation and potential legal action.
Clue confirmation
The clue word "best" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Wipe and rebuild all affected systems.
Why it's wrong here
Wiping destroys forensic evidence needed for investigation.
✗
Notify law enforcement immediately.
Why it's wrong here
Notification should occur after evidence collection and internal escalation.
✗
Pay the ransom to restore operations quickly.
Why it's wrong here
Paying ransom encourages attackers and does not guarantee recovery.
Common exam traps
Common exam trap: answer the scenario, not the keyword
ISC2 often tests the misconception that containment (isolation) is the final step, but the trap here is that candidates skip forensic preservation and jump to remediation (wipe/rebuild) or external actions (law enforcement/payment), failing to recognize that evidence must be secured first to support both investigation and potential recovery.
Detailed technical explanation
How to think about this question
Forensic preservation in ransomware incidents often involves creating bit-for-bit disk images using tools like dd or FTK Imager, capturing volatile memory with tools like LiME or WinPmem, and securely hashing all evidence with SHA-256 to maintain chain of custody. A subtle behavior is that some ransomware variants attempt to delete volume shadow copies (VSS) and event logs, so forensic acquisition must be performed quickly before the malware's cleanup routines execute. In real-world scenarios, preserved evidence can reveal the ransomware's encryption algorithm (e.g., AES-256 with RSA-2048 key wrapping), enabling decryption without payment if a flaw or master key is discovered.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security team runs a vulnerability scan on a web application and discovers an unpatched SQL injection flaw. The team prioritises remediation by CVSS score — critical flaws are patched within 24 hours, high within 7 days. Questions like this test whether you understand vulnerability management processes, scanning tools, and remediation prioritisation.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this CC question in full detail.
Business Continuity, DR & Incident Response — This question tests Business Continuity, DR & Incident Response — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Preserve forensic evidence from the isolated systems. — After isolating affected systems during a ransomware incident, the next best step is to preserve forensic evidence from those systems. This ensures that data such as memory dumps, logs, and encrypted files are captured intact for analysis, which is critical for understanding the attack vector, identifying the ransomware variant, and potentially recovering data without paying the ransom. Forensic preservation must occur before any remediation steps like wiping or rebuilding, as those actions would destroy the evidence needed for investigation and legal proceedings.
What should I do if I get this CC question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "best". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.