CISSP Practice Question: A security analyst confirms an active ransomware infection on a critical database…

Correct Answer: A. Isolate the affected system from the network

Explanation (CISSP Manager Logic):

Once an incident is confirmed during the detection and analysis phase, the immediate priority is containment. In the case of ransomware, isolation prevents the malware from spreading to other network segments and stops the encryption process from reaching additional data stores.

By isolating the system, you:

• Halt the lateral movement of the threat actor or malware.
• Minimize the total scope of the damage to the organization.
• Preserve the current state of the volatile memory for later forensic analysis.

While the other options are relevant, they fall short because:

• B: Identification of root cause occurs during the analysis and eradication phases, but only after the threat is contained.
• C: Restoration is part of the recovery phase and should only occur once the environment is confirmed clean.
• D: Notification is a legal or policy requirement that typically follows containment and a full impact assessment.

Think like a manager:

Prioritize the protection of the environment as a whole. Containment is the bridge between confirming an attack and beginning the cleanup; without it, the incident continues to grow.