nerdexam
Isaca

CISM · Question #457

Which of the following is the BEST way to ensure the capability to restore clean data after a ransomware attack?

The correct answer is A. Maintain multiple offline backups. Ransomware propagates across connected systems and encrypts everything it can reach - including network shares, cloud-synced storage, and online backups. Offline (air-gapped) backups are physically or logically disconnected from the network and therefore unreachable by…

Submitted by kwame.gh· Apr 18, 2026Information Security Incident Management

Question

Which of the following is the BEST way to ensure the capability to restore clean data after a ransomware attack?

Options

  • AMaintain multiple offline backups.
  • BRestore the data to a staging server.
  • CEngage a forensics team.
  • DEncrypt sensitive production data.

How the community answered

(58 responses)
  • A
    76% (44)
  • B
    14% (8)
  • C
    7% (4)
  • D
    3% (2)

Explanation

Ransomware propagates across connected systems and encrypts everything it can reach - including network shares, cloud-synced storage, and online backups. Offline (air-gapped) backups are physically or logically disconnected from the network and therefore unreachable by ransomware, ensuring at least one clean copy of data survives the attack. Maintaining multiple copies adds redundancy against backup corruption or failure. Restoring to a staging server (B) is a recovery action, not a protection measure; engaging forensics (C) supports investigation; encrypting production data (D) does not protect against ransomware, which can encrypt already-encrypted data.

Topics

#Ransomware Recovery#Data Backup#Business Continuity#Incident Response

Community Discussion

No community discussion yet for this question.

Full CISM Practice