SC-100 · Question #336
You are designing a ransomware mitigation strategy. You perform a ransomware risk assessment and identify business-critical assets. You need to recommend a solution to mitigate ransomware threats…
The correct answer is C. Implement immutable, offline backups that have restricted access and test restore procedures D. Deploy Privileged Identity Management (PIM) that uses just-in-time (JIT) access and approval. Microsoft's ransomware mitigation best practices center on two pillars: protecting backup integrity and restricting privileged access. C is correct because immutable, offline backups with restricted access are the primary recovery mechanism when ransomware encrypts production…
Question
You are designing a ransomware mitigation strategy. You perform a ransomware risk assessment and identify business-critical assets. You need to recommend a solution to mitigate ransomware threats. The solution must follow Microsoft security best practices. Which two actions should you include in the recommendation? Each correct answer presents a complete solution. NOTE: Each correct answer is worth one point.
Options
- AEnable firewall logging for auditing, without restricting inbound or outbound traffic.
- BUse extended patching cycles to reduce the risk of update-related service disruptions.
- CImplement immutable, offline backups that have restricted access and test restore procedures
- DDeploy Privileged Identity Management (PIM) that uses just-in-time (JIT) access and approval
How the community answered
(28 responses)- A7% (2)
- B7% (2)
- C86% (24)
Explanation
Microsoft's ransomware mitigation best practices center on two pillars: protecting backup integrity and restricting privileged access. C is correct because immutable, offline backups with restricted access are the primary recovery mechanism when ransomware encrypts production data. Testing restore procedures ensures the backup is actually usable when needed - an untested backup is not a reliable backup. D is correct because Privileged Identity Management (PIM) with just-in-time (JIT) access directly limits the blast radius of ransomware that attempts to spread using compromised privileged credentials. By ensuring admin rights are granted only on-demand and for limited time windows, attackers cannot leverage always-on privileged accounts to move laterally or disable defenses. A is incorrect because logging without traffic restriction provides no mitigation - it only aids forensics after the fact. B is incorrect and dangerous: delaying patches extends the window during which known vulnerabilities (a primary ransomware entry vector) remain exploitable.
Topics
Community Discussion
No community discussion yet for this question.