← Back to Domains
Security — Associate Level

Scenario 1: Ransomware Incident Response

Situation Brief
It's 2:17am. Your organization's monitoring system has flagged unusual outbound traffic from three servers in the finance department. An on-call engineer has confirmed that files on one server are being renamed with an unknown extension. You have been paged as the security lead. The board will call in 30 minutes.
Threat Level
CRITICAL
Time Pressure
30 min
Systems at Risk
3 Servers
Assessment Stages
Identify & Assess Contain & Advise Recovery Plan

Use AI to work through each stage. Your approach will be evaluated — not just your answers.