CAS-002 · Question #751
A new piece of ransomware got installed on a company's backup server which encrypted the hard drives containing the OS and backup application configuration but did not affect the deduplication data…
The correct answer is D. Restoring the data will be difficult without the application configuration. The ransomware destroyed the backup application configuration, making the intact deduplicated data effectively unrestorable without it. The configuration holds the catalog, deduplication mappings, and restore metadata required to make that data usable.
Question
A new piece of ransomware got installed on a company's backup server which encrypted the hard drives containing the OS and backup application configuration but did not affect the deduplication data hard drives. During the incident response, the company finds that all backup tapes for this server are also corrupt. Which of the following is the PRIMARY concern?
Options
- ADetermining how to install HIPS across all server platforms to prevent future incidents
- BPreventing the ransomware from re-infecting the server upon restore
- CValidating the integrity of the deduplicated data
- DRestoring the data will be difficult without the application configuration
How the community answered
(53 responses)- A6% (3)
- B11% (6)
- C19% (10)
- D64% (34)
Why each option
The ransomware destroyed the backup application configuration, making the intact deduplicated data effectively unrestorable without it. The configuration holds the catalog, deduplication mappings, and restore metadata required to make that data usable.
Installing HIPS is a future-prevention measure and is not the primary concern during active incident response and recovery operations.
Preventing reinfection is a valid concern but is secondary to the immediate problem of being unable to restore data at all due to the missing configuration.
The question explicitly states the deduplication data drives were NOT affected by the ransomware, so validating their integrity is not the primary concern.
Backup application configuration contains the deduplication catalog, job definitions, and metadata mappings that tell the application how to reassemble deduplicated chunks into usable data. Without this configuration, the deduplication data drives - though physically intact - cannot be interpreted or restored by the backup software. Rebuilding this configuration from scratch is the primary obstacle to recovery.
Concept tested: Backup recovery dependency on application configuration
Source: https://csrc.nist.gov/publications/detail/sp/800-34/rev-1/final
Topics
Community Discussion
No community discussion yet for this question.