Ransomware Incident Response: Forensic Imaging vs. Containment

CS0-003 By islever Editorial Last updated

Given a scenario, perform incident response activities

Short answer

C Acquire a bit-level image of the affected workstation.

Question

A security analyst discovers an ongoing ransomware attack while investigating a phishing email. The analyst downloads a copy of the file from the email and isolates the affected workstation from the network. Which of the following activities should the analyst perform next?
  1. Wipe the computer and reinstall software
  2. Shut down the email server and quarantine it from the network
  3. Acquire a bit-level image of the affected workstation Correct Answer
  4. Search for other mail users who have received the same file

Key Takeaways

The exam tests the understanding that while stopping spread is vital, preserving volatile and non-volatile evidence from the already isolated source system takes precedence over identifying other potential victims in this specific scenario.

This question tests the correct sequence of incident response activities during an ongoing ransomware attack, specifically prioritizing forensic evidence preservation after initial containment. The page establishes that acquiring a bit-level image is the critical next step to prevent data loss before further investigation.

Common mistake: Many candidates incorrectly choose to search for other affected mail users (Option D), believing that preventing further spread is the immediate priority over securing the evidence on the already isolated infected workstation.

Expert Analysis

Why the Answer Is Correct

After the analyst has isolated the affected workstation, the system is no longer connected to the network, effectively containing the immediate lateral movement threat. The next logical step in the incident response lifecycle, particularly for forensics, is to preserve the state of the compromised system. Acquiring a bit-level image (Option C) ensures that all data, including deleted files, metadata, and volatile memory contents if captured via live forensics prior to imaging, is preserved exactly as they were at the time of isolation. This is crucial for root cause analysis, legal proceedings, and understanding the malware's behavior without altering the original evidence.

Why the Other Options Are Wrong

Wiping the computer (Option A) destroys evidence and should never be done until post-incident recovery planning is complete. Shutting down the email server (Option B) is an overreaction that causes significant business disruption; the single workstation was already isolated, so the primary vector is contained. Searching for other mail users (Option D) is important for broader scope assessment, but it does not address the need to preserve the evidence from the confirmed infected host. Furthermore, simply receiving an email attachment does not guarantee infection, making Option D less urgent than securing the known compromised asset.

Community Comment Notes

The community is divided, with many arguing for Option D based on general containment principles. However, expert analysis and several commenters like 'a3432e2' emphasize that once the scene is secured (isolated), preserving the forensic image is the standard procedure. As one commenter noted, "Acquiring the forensic image takes precedence to ensure that evidence is properly preserved before further actions are taken." Another pointed out that "just receiving the file doesn't mean the ransomware has been executed," highlighting why Option D is less critical than Option C.

Exam Strategy

In incident response questions, always look for the step that preserves evidence or stabilizes the immediate environment before moving to eradication or recovery. If a system is already isolated, do not jump to broad organizational actions like shutting down servers or notifying everyone unless explicitly stated that the threat is spreading uncontrollably.

Frequently Asked Questions

Why isn't shutting down the email server the right choice?

Shutting down the email server causes unnecessary business disruption. Since the infected workstation was already isolated, the immediate threat of lateral movement from that specific machine is contained.

Is searching for other users more important than imaging?

No. While identifying other victims is important, the evidence on the confirmed infected system must be preserved first. Receiving an email does not guarantee infection, making imaging the higher-priority action.

More CS0-003 FAQ →

Discussion 37 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 37

  1. Cpt_Emerald 👍 29 Answered D
    Answer is D. The analyst has already contained the original infected machine. Next would be to identify the scope of the malware (how many users have been affected). After the spread has been contained, the analyst can go back and acquire the bit level image for further forensics. Incident response steps guys.
  2. Kmelaun 👍 23
    READ BEFORE YOU TYPE... Searching for other mail users who may have been affected would be preventing further damage! Have you took the test? Or passed it? Please fix you inner self because it's very unprofessional to be calling people names based off a difference in opinion. God bless!
  3. Kmelaun 👍 10 Answered D
    This information is directly from CertMaster Topic 8B: Incident responders must make quick decisions regarding the most effective containment technique when a system is compromised. The course of action depends on several factors: Ensure the safety and security of all personnel. The first concern of all managers involved with the security response is the safety and security of personnel. Prevent further damage. This will be the overriding priority after the identification of the compromise. Identify whether the intrusion is a primary or a secondary attack (part of a more complex campaign). Avoid alerting the attacker that they have been discovered. Preserve forensic evidence of the intrusion. While waiting for the forensics analyst to arrive, treat the system like any crime scene by preventing anyone from further compromising the system or destroying evidence. Therefore, D would be the most logical answer if we are using this information because it prevents further damage.
  4. a3432e2 👍 6 Answered C
    As a Computer forensic analyst at a sheriff's office office, our training has always been "C. Acquire a bit-level image of the affected workstation" first. While this is an important follow-up action to prevent further spread of the ransomware, it is secondary to preserving the forensic evidence from the affected workstation. Identifying other recipients helps in understanding the scope of the attack but should come after securing and analyzing the evidence from the primary affected machine.
  5. salthehash 👍 5 Answered C
    While searching for other mail users who have received the same file (option D) is important for understanding the attack's propagation and identifying potentially affected systems, it may not be the immediate next step after isolating the affected workstation. Acquiring the forensic image takes precedence to ensure that evidence is properly preserved before further actions are taken.
Show 25 more comments
  1. DustyRex1 👍 5 Answered D
    issue is ongoing, making sure it doesnt spread more is the priority over making a copy
  2. deeden 👍 4 Answered D
    Wow this is a good one. I feel like D is the next move because it's just not clear whether the threat has been contained after workstation was isolated. If it is, then people need to be warned first of an ongoing threat so they don't click on any bait. Secure the scene first before starting investigation.
  3. RobV 👍 4 Answered C
    Both Option C and Option D can be part of a comprehensive incident response plan, but if prioritization is necessary, acquiring a bit-level image is often considered an early and essential step in preserving evidence and understanding the immediate impact on the affected system.
  4. Alizade 👍 4 Answered C
    The answer is C. Acquire a bit-level image of the affected workstation.
  5. section8santa 👍 3 Answered C
    Acquiring a bit-level image (also known as a forensic image) of the affected workstation is crucial for a couple of reasons: Evidence Preservation: It ensures that all the data on the workstation is preserved in its current state, which is essential for any subsequent forensic investigation. This can help in understanding how the ransomware infection occurred, which could be useful in preventing future attacks. Analysis: With a complete image of the workstation, analysts can perform in-depth analysis without the risk of further contaminating the network or losing critical data. The other options, while potentially relevant in certain contexts, are not the immediate next steps:
  6. Anonymous learner 👍 3 Answered D
    D) search for other users. Phishing emails spread like wild fire if not contained. The question states this is ongoing, so it's possible other users can be affected. C is not a viable option, as fixing one workstation is rather pointless if the ransomware spreads to other workstations. Letting the forest burn to save a tree.
  7. cy_analyst 👍 3 Answered C
    D refers to searching for mail users who have received the same file, not necessarily those who are already infected. This distinction is critical because just receiving the file doesn't mean the ransomware has been executed on their systems.
  8. kmordalv 👍 3 Answered D
    Apologies. After careful analysis of the question, option D is the most logical choice for the proposed scenario.
  9. myazureexams 👍 2
    Certmaster topic 8 is not very clear on ransomware but it gives this link https://www.cisa.gov/stopransomware/ransomware-guide From that guide the steps are somewhat clearer, but sort of confusing. From the link I get that it should be Isolate , but then the next steps are to shutdown and disconnect from network, then also investigate other affected users to include "email". So this questions is very confusing. So is it B, C, or D. It does use the word "NEXT" -- so it would mean shut down - B --- what do you all think? based on that link.
  10. Kaneshiro 👍 2 Answered D
    The answer is D. The question states that a ransomware attack is underway. Therefore, once the affected machine is quarantined, it can be easily reviewed later, or you can ask someone else to take the image while you check for other affected users and the ransomware from spreading. You must first contain the threat and then gather evidence. If you take the image first, other users may be opening emails about the attack and worsen the situation.
  11. LiveLaughToasterBath 👍 2 Answered C
    Think in terms of a hospital, whose patient PII has been ransomed. This is now a criminal matter. This device has been ransomwared, this device is now evidence. Ideally someone else on your team is going to alert others to not click on that link or investigate further, but you, with your one task of investigating that device, need to preserve the volatile/ephemeral evidence.
  12. kmordalv 👍 2 Answered C
    Correct Acquiring a bit-level image of the affected workstation is a critical step in the incident response process. This involves creating a forensic copy of the system's entire hard drive or storage media. It allows the analyst to preserve the current state of the system for further analysis and investigation while ensuring that no data is lost or tampered with.
  13. ms123451 👍 2 Answered D
    This is the containment stage and not eradication, in containment you would go and prevent further damage to contain the incident, the isolated computer is already hit with ransomware bit level backup won't make a difference at this point, contain first then move to bit level and forensics to eradicate then wipe clean
  14. robizman 👍 2 Answered C
    • A bit-level image preserves the entire state of the system, including deleted files, memory artifacts, and malware traces. • It ensures evidence integrity for forensic analysis and potential legal proceedings. • It allows analysts to investigate the ransomware behavior without altering the original system.
  15. a3432e2 👍 2
    A bit-level image, (forensic image) is an exact sector-by-sector copy of the entire hard drive or storage device. (This includes all files, metadata, system configurations, deleted files, and unallocated space). C is the next step needed.
  16. bes_i 👍 2 Answered C
    C. Acquire a bit-level image of the affected workstation. THIS STEP SHOULD BE AFTER CONTAINED THE ORIGINAL INFECTED MACHINE
  17. 0ee8014 👍 2 Answered C
    creating a bit level image called forensic image captures the entire content of the hard drive at that point in time.
  18. cj207800 👍 1 Answered C
    The analyst should acquire a bit-level image of the affected workstation. This step is critical because creating a forensic image preserves all digital evidence on the compromised device, which is essential for understanding the attack, supporting investigations, and potentially meeting legal or regulatory requirements. Wiping or restoring the system too soon can destroy valuable forensic artifacts, and shutting down other systems or searching for additional victims should come after evidence is preserved
  19. Justheretolook 👍 1 Answered C
    The correct answer is: C. Acquire a bit-level image of the affected workstation Explanation: After isolating the affected workstation, the next step in incident response—especially for ransomware and forensic investigations—is to preserve evidence. Creating a bit-level image of the affected system ensures that all data, including potentially hidden or deleted files and malware artifacts, is preserved for further analysis or legal investigation.
  20. robizman 👍 1 Answered C
    From gpt5: Why This Is the Correct Step: A bit-level image is a forensic copy of the entire system, including deleted files, hidden data, and system artifacts. It preserves evidence for investigation, legal action, and understanding the attack vector. Imaging should be done before any remediation (like wiping or reinstalling), to avoid destroying critical forensic data.
  21. chaddman 👍 1
    Search for other mail users who have received the same file (D): Since the ransomware came through a phishing email, it's crucial to identify other potential victims as quickly as possible to contain the spread of the attack. This would help in taking immediate remedial actions, like isolating affected machines or warning users not to open the malicious file.
  22. eddy72 👍 1
    answer is C. Creating a bit-level image of the affected workstation captures a complete snapshot of the entire disk. This image can be used for forensic analysis later to understand the attack scope, identify potential entry points, and potentially recover data if decryption isn't feasible.
  23. GDLY 👍 1 Answered D
    In a real world scenario, you will have teammates. One can do the bit-level, while the others can focus on the real priority which is to contain the spread of ransomware. Based on severity, containing the spread takes precedence over image. So I'm going with D.
  24. robizman 👍 1
    @Kaneshiro, note the question's catch "The analyst downloads a copy of the file from the email and isolates the affected workstation from the network". So the affected workstation has been isolated. The correct answer should be C
  25. Sebatian20 👍 1
    Before you do this "need to preserve the volatile/ephemeral evidence." - you need to consult legal.. thus. legal should be your next step. So with this question - I believe D is the correct answer.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Mitigating New Ransomware with Sandboxing Analysis

S-grade

Identifying Network Routing Anomalies Using ASN Lookups

S-grade

Next Step After Applying a Patch: Validation vs. Testing

S-grade

Missing Data from Network Vulnerability Scans

S-grade

← Back to CS0-003 Study Guide