CISM · Question #235
Which of the following BEST enables the restoration of operations after a limited ransomware incident occurs?
The correct answer is C. Reliable image backups. Ransomware encrypts systems and data, making restoration of clean system images the most direct path to recovering operations. Reliable image backups allow the organization to wipe compromised systems and restore them to a known-good state without paying a ransom. Root cause…
Question
Which of the following BEST enables the restoration of operations after a limited ransomware incident occurs?
Options
- ARoot cause analysis
- BDocumented eradication procedures
- CReliable image backups
- DImpact assessment
How the community answered
(23 responses)- A4% (1)
- B9% (2)
- C70% (16)
- D17% (4)
Explanation
Ransomware encrypts systems and data, making restoration of clean system images the most direct path to recovering operations. Reliable image backups allow the organization to wipe compromised systems and restore them to a known-good state without paying a ransom. Root cause analysis (A) is valuable after recovery but does not restore operations. Documented eradication procedures (B) help remove the threat but cannot restore encrypted data. Impact assessment (D) quantifies damage but does not enable recovery. Only having intact, tested, and uncompromised backups directly enables restoration.
Topics
Community Discussion
No community discussion yet for this question.