mediumMultiple SelectObjective-mapped
SSCP Practice Question: Has detected a ransomware infection on a critical…
An organization has detected a ransomware infection on a critical file server. The incident response team has been activated. Which TWO actions should be performed FIRST during the initial response phase?
⚠ Common exam trap
ISC2 often tests the misconception that identifying the ransomware variant (Option A) is the first step, but in the SSCP framework, containment (disconnection) and scoping (identifying affected systems) are the immediate priorities during the initial response phase.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Immediately disconnect the file server from the network
Immediately disconnecting the file server from the network is a critical containment action that stops the ransomware from encrypting additional files on the server and prevents lateral movement to other systems. This aligns with the first priority in incident response: containment before eradication or recovery. Disconnecting at the switch port or disabling the network interface card (NIC) is preferred over a graceful shutdown to avoid triggering any persistence mechanisms.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Determine the type of ransomware variant
Why it's wrong here
Incorrect: While useful, determining the variant is part of analysis, not a first action.
- ✓
Immediately disconnect the file server from the network
Why this is correct
Correct: Immediate containment prevents further encryption or lateral movement.
- ✗
Reimage the file server using a known good backup
Why it's wrong here
Incorrect: Reimaging is recovery, which comes after containment and analysis.
- ✓
Identify all affected systems and scope of infection
Why this is correct
Correct: Scoping is crucial early to understand impact and guide containment.
- ✗
Notify law enforcement authorities
Why it's wrong here
Incorrect: Notification is important but not a first step; must be done after internal actions.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 920-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.