ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

The first priority after identifying active ransomware is containment to stop the malware from spreading or communicating with its command-and-control infrastructure. Physically or logically disconnecting the infected server from the network prevents the ransomware from propagating to other systems and halts further data encryption. Only after containment is confirmed should the team proceed with eradication steps such as wiping the system, restoring from clean backups, applying patches, and improving defenses. Paying the ransom is discouraged, and updating signatures or contacting law enforcement, while important, does not immediately stop ongoing damage.