Problem Statement
During a ransomware attack, which response action should come first?
Explanation
Immediate containment prevents the malware from spreading laterally.
Once isolated, forensic teams can analyze the encryption type and restore data from clean backups.