Ransomware response: contain, recover, and report

What you’ll practice

Ransomware response is a sequence of high-stakes decisions, and this quiz helps you rehearse them without the pressure of a live incident. You’ll practice identifying the right next step for contain, recover, and report across mixed-difficulty scenarios.

Each question uses 4 options and there’s no timer, so you can slow down and think through evidence, dependencies, and risk.

Common pitfalls to avoid

Many responders lose time by focusing on eradication before containment, or by restoring systems before validating backups and access paths. Another frequent mistake is inconsistent communication: unclear status updates, missing legal/privacy considerations, or premature attribution.

How difficulty and length work

Difficulty is balanced as “Mixed,” blending foundational concepts (like isolation and triage) with tougher judgment calls (like restore sequencing and stakeholder reporting). Choose your preferred question count and difficulty before you start to tailor the session to a quick refresher or a full drill.

Quick checklist for better scores

• Prioritize containment actions that stop spread before deep forensics
• Distinguish business impact decisions from technical cleanup tasks
• Validate backups and recovery points before large-scale restoration
• Track evidence handling and documentation for later reporting
• Align notifications with policy, regulation, and contractual obligations