In a ransomware incident, what is the first containment action you should take?

• A. Pay ransom
• B. Isolate affected hosts
• C. Notify customers
• D. Restore from backups

Answer: (B)

The main concept being tested is containment by isolating the affected systems to stop the ransomware from spreading. When a ransomware outbreak begins, the malware can move laterally across the network, encrypting more hosts and locking up data. Isolating the compromised machines cuts off their ability to communicate with other devices and share encrypting routines, which immediately reduces the blast radius and protects remaining assets. This creates a safe window for responders to analyze the scope, preserve volatile data and forensic evidence, and plan a proper recovery without the threat continuing to propagate.

After containment, you can focus on recovery steps such as validating and restoring from clean backups, and implementing measures to prevent re-infection. Other actions like paying the ransom or notifying customers are important considerations, but they are not the first action to stop the incident and limit damage; payment offers no guaranteed data recovery and can fund further crimes, while notification and public-facing steps come later once containment and assessment are in progress.