ISC2 CC Business Continuity, DR & Incident Response Practice Question
During a ransomware incident, the incident response team isolates affected systems. Which of the following is the NEXT best step?
⚠ Common exam trap
ISC2 often tests the misconception that containment (isolation) is the final step, but the trap here is that candidates skip forensic preservation and jump to remediation (wipe/rebuild) or external actions (law enforcement/payment), failing to recognize that evidence must be secured first to support both investigation and potential recovery.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Preserve forensic evidence from the isolated systems.
After isolating affected systems during a ransomware incident, the next best step is to preserve forensic evidence from those systems. This ensures that data such as memory dumps, logs, and encrypted files are captured intact for analysis, which is critical for understanding the attack vector, identifying the ransomware variant, and potentially recovering data without paying the ransom. Forensic preservation must occur before any remediation steps like wiping or rebuilding, as those actions would destroy the evidence needed for investigation and legal proceedings.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Preserve forensic evidence from the isolated systems.
Why this is correct
Preserving evidence supports investigation and potential legal action.
- ✗
Wipe and rebuild all affected systems.
Why it's wrong here
Wiping destroys forensic evidence needed for investigation.
- ✗
Notify law enforcement immediately.
Why it's wrong here
Notification should occur after evidence collection and internal escalation.
- ✗
Pay the ransom to restore operations quickly.
Why it's wrong here
Paying ransom encourages attackers and does not guarantee recovery.
Go deeper
Related to this question
Learn chapter
Incident Response and Management
Key term
Ransomware
Ransomware is a type of malicious software that encrypts a victim's files or locks them out of their system, demanding payment, usually in cryptocurrency, to restore access.
Key term
Incident response
Incident response is the structured approach an organization uses to identify, contain, and recover from cybersecurity incidents like data breaches or ransomware attacks.
About these practice questions
Courseiva writes every CC question from scratch — 976 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.