PROLABLOCKEDGuided lab · 60 minutes

Incident Response Lab 1 — Ransomware First Response

A complete first-response exercise: prioritize containment, preserve evidence, evaluate recovery and produce a reasoned incident update.

Available now

What you will practise

A fictional service desk reports inaccessible files and several endpoint alerts. The exercise uses written injects only; it contains no malware or executable samples.

  • Identify immediate safety and business priorities
  • Distinguish evidence preservation from containment decisions
  • Escalate using the incident communication plan

Member content

Sign in for Pro learning

Eligible Pro members can open the available labs and full Simulations B and C. Each includes worked explanations to help you review your reasoning. Pro includes the available collection. Planned curriculum is listed under Coming next.

Recurring membership. Both plans include the same available Pro collection. Compare the complete offer.

Manage an existing membership · Keep learning free