Recover from a Ransomware Attack CERTIFIED-CYBER-RESILIENCY-EXPERT Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which activity is part of post-recovery improvement?

   • ADeleting all logs from the affected systems
   • BRestoring the systems to their pre-attack state without changes
   • CUpdating the incident response plan based on lessons learned
   • DDisabling all security monitoring tools
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company's backup administrator is restoring data from a backup that was taken two days before a ransomware attack. The backup is stored on a separate backup server that was not affected by the attack. After restoring the data to a staging area, the administrator notices that some files are still encrypted. What should the administrator do next?

   • AProceed with the restored data, as the encryption may only affect a few files and can be handled later.
   • BRestore from an older backup that predates the attack and verify the files are clean.
   • CRe-run the same backup restoration process, assuming the encryption was a temporary glitch.
   • DRun a decryption tool provided by the ransomware attackers to unlock the files.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company has successfully recovered from a ransomware attack. The incident response team is conducting a post-recovery review. Which activity is most important to include in this review?

   • ARestore all systems to the exact state they were in before the attack.
   • BIdentify the initial attack vector and the security gaps that allowed the ransomware to enter.
   • CImmediately resume normal operations without further analysis to minimize downtime.
   • DDelete all logs from the affected systems to free up storage space.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which action is an example of containing a ransomware infection?

   • ADisconnecting infected systems from the network
   • BNotifying law enforcement agencies
   • CDeleting all files on the infected systems
   • DImmediately restoring all systems from the latest backup
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the purpose of conducting a post-recovery analysis after a ransomware incident?

   • ATo determine if the ransomware was a false positive
   • BTo identify gaps in the response and improve future prevention and recovery
   • CTo assign blame to individuals for the attack
   • DTo calculate the exact financial loss for insurance claims
   Reveal Solution Discussion Select an answer first