During an active ransomware incident, an analyst confirms three file servers are encrypting shares and the malware is spreading laterally over SMB. Executives are pressing for a full rebuild of the affected servers straight away. Following the incident response lifecycle, what should the analyst do next?
- AWipe and rebuild the three file servers immediately to restore service for the business
- BIsolate the affected servers from the network to stop the lateral spread before any rebuild begins Correct
- CRun a full antivirus scan across every server to remove the ransomware binary from disk
- DBegin drafting the lessons-learned report while the encryption is still in progress
Why A is wrong: Rebuilding is a recovery task and appeals to executive pressure, but doing it while the malware is still spreading leaves other hosts exposed and destroys evidence needed for scoping.
Why B is correct: Containment precedes eradication and recovery in the lifecycle; isolating the hosts halts further encryption and lateral movement, which is the priority while spread is active.
Why C is wrong: Scanning to remove the binary is eradication and sounds decisive, but it does not stop the active lateral spread and comes before the incident is contained.
Why D is wrong: Lessons learned is a genuine phase and tempts an analyst wanting to capture detail early, but it is the final phase and does nothing to address an incident still unfolding.