Which action must be taken prior to a successful ransomware attack to enable recovery from the attack?

Question

Exhibit

Options

• Acreate a data snapshot on your IDS device
• Bback up systems that contain critical data
• Cupdate all firewall malware signatures
• Dlimit external exposure of internal DNS resource records

• A
  5% (2)
• B
  89% (34)
• C
  3% (1)
• D
  3% (1)

Explanation

Backing up systems containing critical data (B) is the only pre-attack action that actually enables recovery - ransomware encrypts your data and demands payment, but clean, offline backups let you restore without paying the ransom. Option A is wrong because IDS devices capture network traffic/alerts, not restorable data snapshots. Option C is wrong because updating firewall signatures is a prevention measure, not a recovery enabler - and attackers frequently use zero-day or obfuscated payloads that bypass signature detection anyway. Option D is wrong because limiting DNS exposure reduces attack surface but does nothing to help you recover data once encryption has occurred.

Memory tip: Focus on the word recovery in the question. Ask yourself: "If ransomware already succeeded and all my files are encrypted, which action from before the attack would let me get them back?" Only a backup answers that - everything else is prevention or detection.

No community discussion yet for this question.