CISM · Question #457
Which of the following is the BEST way to ensure the capability to restore clean data after a ransomware attack?
The correct answer is A. Maintain multiple offline backups. Ransomware propagates across connected systems and encrypts everything it can reach - including network shares, cloud-synced storage, and online backups. Offline (air-gapped) backups are physically or logically disconnected from the network and therefore unreachable by…
Question
Which of the following is the BEST way to ensure the capability to restore clean data after a ransomware attack?
Options
- AMaintain multiple offline backups.
- BRestore the data to a staging server.
- CEngage a forensics team.
- DEncrypt sensitive production data.
How the community answered
(58 responses)- A76% (44)
- B14% (8)
- C7% (4)
- D3% (2)
Explanation
Ransomware propagates across connected systems and encrypts everything it can reach - including network shares, cloud-synced storage, and online backups. Offline (air-gapped) backups are physically or logically disconnected from the network and therefore unreachable by ransomware, ensuring at least one clean copy of data survives the attack. Maintaining multiple copies adds redundancy against backup corruption or failure. Restoring to a staging server (B) is a recovery action, not a protection measure; engaging forensics (C) supports investigation; encrypting production data (D) does not protect against ransomware, which can encrypt already-encrypted data.
Topics
Community Discussion
No community discussion yet for this question.