Ransomware Incident Containment: Immediate Steps to Take
Which TWO actions should an analyst take when a confirmed ransomware incident is detected on multiple endpoints? (Choose TWO.)
Quick Answer
The answer is to block known malicious IP addresses and domains in the firewall and isolate the affected endpoints from the network. Isolating endpoints stops the ransomware from encrypting additional files on the local machine, while blocking indicators of compromise at the firewall prevents the malware from communicating with its command-and-control server to receive further instructions or spread laterally. On the SC-200 exam, this question tests your understanding of the immediate containment phase within the NIST incident response framework, where the priority is to halt the attack’s propagation before any remediation. A common trap is choosing to run a full antivirus scan or disconnect from the internet entirely—scanning can destroy volatile evidence needed for forensic analysis, and disconnecting endpoints alone does not block the attacker’s infrastructure. Remember the mnemonic “Isolate and Block” for immediate containment: isolate the host, block the indicators.
⚠ Common exam trap
Test-takers frequently confuse 'isolation' with 'shutdown' or 'disconnect', not realizing that isolation preserves forensic data and allows remote management, while shutdown destroys volatile evidence and may accelerate data loss.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate affected endpoints using Microsoft Defender for Endpoint.
Microsoft Defender for Endpoint's device isolation feature immediately severs all network communication (both inbound and outbound) from the affected endpoint while keeping the device powered on for forensic analysis. This containment action prevents lateral movement and further encryption of data across the network, which is critical during a ransomware incident.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Run a full antivirus scan on all endpoints.
Why it's wrong here
Scanning is slow and does not immediately contain the threat.
- ✓
Isolate affected endpoints using Microsoft Defender for Endpoint.
Why this is correct
Immediately contains the threat by isolating devices.
- ✓
Block known malicious IP addresses and domains in the firewall.
Why this is correct
Prevents communication with command and control servers.
- ✗
Disconnect network cables but leave endpoints powered on.
Why it's wrong here
Encryption may continue if processes are running.
- ✗
Shut down all affected endpoints to prevent data loss.
Why it's wrong here
Shutdown destroys volatile forensic data.
Go deeper
Related to this question
About these practice questions
One of 209 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-200
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO actions should a SOC analyst take immediately after confirming a ransomware incident in Microsoft Defender XDR?
easy- ✓ A.Isolate affected devices from the network.
- B.Begin restoring data from backups.
- C.Disable all mailboxes in the organization.
- ✓ D.Reset passwords for compromised accounts and enforce MFA.
- E.Collect a full memory dump from each affected device.
Why A: Correct answers are A and D. Isolating affected devices and resetting compromised account credentials are immediate containment steps. Collecting forensic data is important but after containment. Starting recovery can wait. Disabling mailboxes is not necessary unless email is a vector.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.