PREPARE · CONTAIN · RECOVER

Incident Response Lab 1 — Ransomware First Response

A complete first-response exercise: prioritize containment, preserve evidence, evaluate recovery and produce a reasoned incident update.

Pro guided learning

Guided labs, worked reviews and Security+ style practice simulations. Learn from evidence, not guesswork.

Available now

What you will practise

A fictional service desk reports inaccessible files and several endpoint alerts. The exercise uses written injects only; it contains no malware or executable samples.

  • Identify immediate safety and business priorities
  • Distinguish evidence preservation from containment decisions
  • Escalate using the incident communication plan

MEMBER CONTENT

Sign in for Pro learning

Eligible Pro members can open the available labs and full Simulations B and C. Each includes worked explanations to help you review your reasoning. Pro includes the available collection. Planned curriculum is listed under Coming next.

Recurring membership. Both plans include the same available Pro collection. Compare the complete offer.

Already a member? Log in or manage your membership before purchasing again.

Manage an existing membership · Keep learning free