CompTIA CySA+ CS0-003 Practice Question

In the case of a ransomware attack, isolating the affected systems is critical to prevent the malware from spreading to other systems. Disconnecting infected machines from the network ensures that the ransomware cannot communicate with external servers or compromise additional data. Re-imaging may be necessary later, but initially, isolation is the priority. Initiating a legal hold and compensating controls are also part of the broader response strategy but are not the first steps to limit immediate impact.