Which of the following is the best countermeasure to encrypting ransomwares?

Running multiple antivirus products can cause resource conflicts and performance degradation, and signature-based detection cannot reliably identify novel or polymorphic ransomware variants before encryption begins.

Offline or air-gapped backups are stored in a location that ransomware cannot reach over the network, ensuring that encrypted data can be fully restored from a clean copy. This approach eliminates the attacker's leverage entirely, making ransom payment unnecessary. It is the primary recovery control recommended by CISA, NIST, and other agencies in their ransomware preparedness guidance.

Modern ransomware employs strong asymmetric encryption where the private decryption key is held solely by the attacker's infrastructure, making it computationally infeasible to recover the key through analysis.

Paying the ransom provides no contractual guarantee of key delivery or full data recovery, and it financially incentivizes continued ransomware campaigns against other victims.