Ransomware Incident Response: Forensic Imaging vs. Containment
Given a scenario, perform incident response activities
A security analyst discovers an ongoing ransomware attack while investigating a phishing email. The analyst downloads a copy of the file from the email and isolates the affected workstation from the network. Which of the following activities should the analyst perform next?
Answer
Correct answer: C — Acquire a bit-level image of the affected workstation.
Community Insight
The exam tests the understanding that while stopping spread is vital, preserving volatile and non-volatile evidence from the already isolated source system takes precedence over identifying other potential victims in this specific scenario.
This question tests the correct sequence of incident response activities during an ongoing ransomware attack, specifically prioritizing forensic evidence preservation after initial containment. The page establishes that acquiring a bit-level image is the critical next step to prevent data loss before further investigation.
Many candidates incorrectly choose to search for other affected mail users (Option D), believing that preventing further spread is the immediate priority over securing the evidence on the already isolated infected workstation.
Community Discussion (37 comments)
Berro_b
👍 1
Selected: D
The analyst has already contained the infected workstation. The next priority is to determine whether other employees received the same malicious attachment so the attack doesn't spread further.
facadex
👍 1
Selected: C
Going with C myself, I agree with searching for others that recieved the e-mail, but not at the expense of any temporary files on the infected computer.
bes_i
👍 2
Selected: C
C. Acquire a bit-level image of the affected workstation. THIS STEP SHOULD BE AFTER CONTAINED THE ORIGINAL INFECTED MACHINE
1chung
👍 1
Selected: D
I go with D
robizman
👍 1
Selected: C
From gpt5: Why This Is the Correct Step: A bit-level image is a forensic copy of the entire system, including deleted files, hidden data, and system artifacts. It preserves evidence for investigation, legal action, and understanding the attack vector. Imaging should be done before any remediation (like wiping or reinstalling), to avoid destroying critical forensic data.
robizman
👍 2
Selected: C
• A bit-level image preserves the entire state of the system, including deleted files, memory artifacts, and malware traces. • It ensures evidence integrity for forensic analysis and potential legal proceedings. • It allows analysts to investigate the ransomware behavior without altering the original system.
Kaneshiro
👍 2
Selected: D
The answer is D. The question states that a ransomware attack is underway. Therefore, once the affected machine is quarantined, it can be easily reviewed later, or you can ask someone else to take the image while you check for other affected users and the ransomware from spreading. You must first contain the threat and then gather evidence. If you take the image first, other users may be opening emails about the attack and worsen the situation.
robizman
👍 1
@Kaneshiro, note the question's catch "The analyst downloads a copy of the file from the email and isolates the affected workstation from the network". So the affected workstation has been isolated. The correct answer should be C
cj207800
👍 1
Selected: C
The analyst should acquire a bit-level image of the affected workstation. This step is critical because creating a forensic image preserves all digital evidence on the compromised device, which is essential for understanding the attack, supporting investigations, and potentially meeting legal or regulatory requirements. Wiping or restoring the system too soon can destroy valuable forensic artifacts, and shutting down other systems or searching for additional victims should come after evidence is preserved
Justheretolook
👍 1
Selected: C
The correct answer is: C. Acquire a bit-level image of the affected workstation Explanation: After isolating the affected workstation, the next step in incident response—especially for ransomware and forensic investigations—is to preserve evidence. Creating a bit-level image of the affected system ensures that all data, including potentially hidden or deleted files and malware artifacts, is preserved for further analysis or legal investigation.
Susan4041
👍 1
Selected: C
I am gonna say C first because you always always preserve your evidence before doing anything else so it doesn't loose its integrity.
GDLY
👍 1
Selected: D
In a real world scenario, you will have teammates. One can do the bit-level, while the others can focus on the real priority which is to contain the spread of ransomware. Based on severity, containing the spread takes precedence over image. So I'm going with D.
cy_analyst
👍 3
Selected: C
D refers to searching for mail users who have received the same file, not necessarily those who are already infected. This distinction is critical because just receiving the file doesn't mean the ransomware has been executed on their systems.
a3432e2
👍 6
Selected: C
As a Computer forensic analyst at a sheriff's office office, our training has always been "C. Acquire a bit-level image of the affected workstation" first. While this is an important follow-up action to prevent further spread of the ransomware, it is secondary to preserving the forensic evidence from the affected workstation. Identifying other recipients helps in understanding the scope of the attack but should come after securing and analyzing the evidence from the primary affected machine.
a3432e2
👍 2
A bit-level image, (forensic image) is an exact sector-by-sector copy of the entire hard drive or storage device. (This includes all files, metadata, system configurations, deleted files, and unallocated space). C is the next step needed.
eddy72
👍 1
answer is C. Creating a bit-level image of the affected workstation captures a complete snapshot of the entire disk. This image can be used for forensic analysis later to understand the attack scope, identify potential entry points, and potentially recover data if decryption isn't feasible.
myazureexams
👍 2
Certmaster topic 8 is not very clear on ransomware but it gives this link https://www.cisa.gov/stopransomware/ransomware-guide From that guide the steps are somewhat clearer, but sort of confusing. From the link I get that it should be Isolate , but then the next steps are to shutdown and disconnect from network, then also investigate other affected users to include "email". So this questions is very confusing. So is it B, C, or D. It does use the word "NEXT" -- so it would mean shut down - B --- what do you all think? based on that link.
DustyRex1
👍 5
Selected: D
issue is ongoing, making sure it doesnt spread more is the priority over making a copy
0ee8014
👍 2
Selected: C
creating a bit level image called forensic image captures the entire content of the hard drive at that point in time.
Kmelaun
👍 23
READ BEFORE YOU TYPE... Searching for other mail users who may have been affected would be preventing further damage! Have you took the test? Or passed it? Please fix you inner self because it's very unprofessional to be calling people names based off a difference in opinion. God bless!
Kmelaun
👍 10
Selected: D
This information is directly from CertMaster Topic 8B: Incident responders must make quick decisions regarding the most effective containment technique when a system is compromised. The course of action depends on several factors: Ensure the safety and security of all personnel. The first concern of all managers involved with the security response is the safety and security of personnel. Prevent further damage. This will be the overriding priority after the identification of the compromise. Identify whether the intrusion is a primary or a secondary attack (part of a more complex campaign). Avoid alerting the attacker that they have been discovered. Preserve forensic evidence of the intrusion. While waiting for the forensics analyst to arrive, treat the system like any crime scene by preventing anyone from further compromising the system or destroying evidence. Therefore, D would be the most logical answer if we are using this information because it prevents further damage.
section8santa
👍 1
but you are contradicting yourself saying that bud. " Preserve forensic evidence of the intrusion. While waiting for the forensics analyst to arrive " read b4 you type bozzo.
section8santa
👍 3
Selected: C
Acquiring a bit-level image (also known as a forensic image) of the affected workstation is crucial for a couple of reasons: Evidence Preservation: It ensures that all the data on the workstation is preserved in its current state, which is essential for any subsequent forensic investigation. This can help in understanding how the ransomware infection occurred, which could be useful in preventing future attacks. Analysis: With a complete image of the workstation, analysts can perform in-depth analysis without the risk of further contaminating the network or losing critical data. The other options, while potentially relevant in certain contexts, are not the immediate next steps:
salthehash
👍 5
Selected: C
While searching for other mail users who have received the same file (option D) is important for understanding the attack's propagation and identifying potentially affected systems, it may not be the immediate next step after isolating the affected workstation. Acquiring the forensic image takes precedence to ensure that evidence is properly preserved before further actions are taken.
Cpt_Emerald
👍 29
Selected: D
Answer is D. The analyst has already contained the original infected machine. Next would be to identify the scope of the malware (how many users have been affected). After the spread has been contained, the analyst can go back and acquire the bit level image for further forensics. Incident response steps guys.
Susan4041
👍 1
Answer is C always always always image your evidence first.
RobV
👍 4
Selected: C
Both Option C and Option D can be part of a comprehensive incident response plan, but if prioritization is necessary, acquiring a bit-level image is often considered an early and essential step in preserving evidence and understanding the immediate impact on the affected system.
deeden
👍 4
Selected: D
Wow this is a good one. I feel like D is the next move because it's just not clear whether the threat has been contained after workstation was isolated. If it is, then people need to be warned first of an ongoing threat so they don't click on any bait. Secure the scene first before starting investigation.
LiveLaughToasterBath
👍 2
Selected: C
Think in terms of a hospital, whose patient PII has been ransomed. This is now a criminal matter. This device has been ransomwared, this device is now evidence. Ideally someone else on your team is going to alert others to not click on that link or investigate further, but you, with your one task of investigating that device, need to preserve the volatile/ephemeral evidence.
Sebatian20
👍 1
Before you do this "need to preserve the volatile/ephemeral evidence." - you need to consult legal.. thus. legal should be your next step. So with this question - I believe D is the correct answer.
👍 3
Selected: D
D) search for other users. Phishing emails spread like wild fire if not contained. The question states this is ongoing, so it's possible other users can be affected. C is not a viable option, as fixing one workstation is rather pointless if the ransomware spreads to other workstations. Letting the forest burn to save a tree.
chaddman
👍 1
Search for other mail users who have received the same file (D): Since the ransomware came through a phishing email, it's crucial to identify other potential victims as quickly as possible to contain the spread of the attack. This would help in taking immediate remedial actions, like isolating affected machines or warning users not to open the malicious file.
Alizade
👍 4
Selected: C
The answer is C. Acquire a bit-level image of the affected workstation.
kmordalv
👍 3
Selected: D
Apologies. After careful analysis of the question, option D is the most logical choice for the proposed scenario.
dcdc1000
👍 1
Answer D Because, the question specifically states this is an ongoing ransomware attack.
ms123451
👍 2
Selected: D
This is the containment stage and not eradication, in containment you would go and prevent further damage to contain the incident, the isolated computer is already hit with ransomware bit level backup won't make a difference at this point, contain first then move to bit level and forensics to eradicate then wipe clean
kmordalv
👍 2
Selected: C
Correct Acquiring a bit-level image of the affected workstation is a critical step in the incident response process. This involves creating a forensic copy of the system's entire hard drive or storage media. It allows the analyst to preserve the current state of the system for further analysis and investigation while ensuring that no data is lost or tampered with.
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
After the analyst has isolated the affected workstation, the system is no longer connected to the network, effectively containing the immediate lateral movement threat. The next logical step in the incident response lifecycle, particularly for forensics, is to preserve the state of the compromised system. Acquiring a bit-level image (Option C) ensures that all data, including deleted files, metadata, and volatile memory contents if captured via live forensics prior to imaging, is preserved exactly as they were at the time of isolation. This is crucial for root cause analysis, legal proceedings, and understanding the malware's behavior without altering the original evidence.Why the Other Options Are Wrong
Wiping the computer (Option A) destroys evidence and should never be done until post-incident recovery planning is complete. Shutting down the email server (Option B) is an overreaction that causes significant business disruption; the single workstation was already isolated, so the primary vector is contained. Searching for other mail users (Option D) is important for broader scope assessment, but it does not address the need to preserve the evidence from the confirmed infected host. Furthermore, simply receiving an email attachment does not guarantee infection, making Option D less urgent than securing the known compromised asset.Community Comment Notes
The community is divided, with many arguing for Option D based on general containment principles. However, expert analysis and several commenters like 'a3432e2' emphasize that once the scene is secured (isolated), preserving the forensic image is the standard procedure. As one commenter noted, "Acquiring the forensic image takes precedence to ensure that evidence is properly preserved before further actions are taken." Another pointed out that "just receiving the file doesn't mean the ransomware has been executed," highlighting why Option D is less critical than Option C.Exam Strategy
In incident response questions, always look for the step that preserves evidence or stabilizes the immediate environment before moving to eradication or recovery. If a system is already isolated, do not jump to broad organizational actions like shutting down servers or notifying everyone unless explicitly stated that the threat is spreading uncontrollably.
Frequently Asked Questions
Why isn't shutting down the email server the right choice?
Shutting down the email server causes unnecessary business disruption. Since the infected workstation was already isolated, the immediate threat of lateral movement from that specific machine is contained.
Is searching for other users more important than imaging?
No. While identifying other victims is important, the evidence on the confirmed infected system must be preserved first. Receiving an email does not guarantee infection, making imaging the higher-priority action.