Question

Difficulty: MediumIncident Response and Chain of Custody

A desktop support technician responds to a report that a Finance department computer is infected with active ransomware that is currently attempting to encrypt shared network drives over a wired connection. System memory and processes are still active. Which TWO actions should the technician perform first to contain the incident while adhering to forensic evidence preservation guidelines?

  1. Unplug the network cable from the computer's network interface cardAnswer
  2. Capture a digital copy of the active system memory (RAM)Answer
  3. C
    Reboot the system into Safe Mode with Networking to execute a full antimalware scan
  4. D
    Open File Explorer to inspect and copy affected files onto a USB flash drive

Answer

The technician should unplug the network cable to isolate the infected computer from the network and capture a digital copy of the active system RAM before taking any reboot or shutdown actions.
Unplugging the network cable isolates the host to prevent ransomware propagation across network shares while keeping system state intact. Capturing system RAM preserves highly volatile evidence, such as running malware routines and memory-resident keys, before any system state changes occur.

Step-by-Step Solution

1
Isolate the compromised system from network resources
Network communication is terminated immediately, preventing the ransomware from spreading to network shares or communicating with external command-and-control servers.
Physical disconnection halts attack escalation without modifying local volatile memory.
2
Preserve volatile memory (RAM)
Active processes, volatile memory artifacts, and potential decryption keys stored in RAM are captured.
System RAM is at the top of the Order of Volatility and is permanently lost if the system is restarted or turned off.

Key Concept

First Responder Incident Isolation and Order of Volatility
Rate this question