Security Operations · Objective 4.8

Scenario

Ransomware is confirmed on one workstation. The share it was encrypting has been disconnected by a user who noticed. What is the next response action?

Incident response activities

Pick an answer. You’ll see if it’s right. The longer explanation is what a plan opens.

28 items in the public index.