What is the immediate goal of isolating affected systems during a ransomware incident?

To prevent the ransomware from spreading to other systems

To test the effectiveness of the backup system

To allow users to continue working on unaffected applications

To preserve evidence for legal proceedings

Why should systems be rebuilt from trusted sources after a ransomware attack?

To avoid reinstalling applications that are no longer needed

To reduce the time needed to restore data from backups

To ensure the operating system is the latest version

To eliminate any residual ransomware or backdoors from the compromised system

Why is it important to verify the integrity of backups before restoring them after a ransomware attack?

To determine the cost of the backup storage

To ensure the backups are free from ransomware or corruption

To confirm that the backups are stored offsite

To check if the backups are encrypted with the correct key

A hospital's IT team detects ransomware on a file server that hosts patient records. The server is connected to the hospital's storage area network (SAN) and is replicated to an offsite backup site. The team suspects the ransomware may have been active for several hours before detection. What should the team do first to minimize further damage?

Begin restoring data from the most recent backup to the file server while it is still online.

Notify the hospital's legal department and wait for their instructions before taking any action.

Run a full antivirus scan on the file server to remove the ransomware before taking any other action.

Disconnect the file server from the network and the SAN, then power it down.

A company's security team detects ransomware on a database server. The server is part of a cluster that also hosts a web application. The team suspects the ransomware may have spread to other servers in the cluster. What should the team do first?

Run a vulnerability scan on the cluster to identify the ransomware's entry point before taking action.

Shut down the entire cluster to prevent any further spread.

Isolate the database server from the network and the cluster, then assess the extent of the infection.

Restore the database from the latest backup immediately without isolating the server.

NetAppCertified Cyber Resiliency Expert

Domain 1Objective 1

Recover from a Ransomware Attack CERTIFIED-CYBER-RESILIENCY-EXPERT Practice Questions (Page 2)

Part of the Ransomware Protection and Detection domain, which accounts for 18% of the CERTIFIED-CYBER-RESILIENCY-EXPERT exam. NetApp does not publish an official question count, but from its 90-minute exam (~35–60 total, ~6–11 in this domain), expect 1–2 from this objective — we provide 15 practice questions to prepare you well beyond it. (estimate)

15questions here

3free pages

5concepts

18%of the exam

Questions 6–10

6foundation · easy
What is the immediate goal of isolating affected systems during a ransomware incident?
Select an answer first
7foundation · easy
Why should systems be rebuilt from trusted sources after a ransomware attack?
Select an answer first
8foundation · easy
Why is it important to verify the integrity of backups before restoring them after a ransomware attack?
Select an answer first
9application · medium
A hospital's IT team detects ransomware on a file server that hosts patient records. The server is connected to the hospital's storage area network (SAN) and is replicated to an offsite backup site. The team suspects the ransomware may have been active for several hours before detection. What should the team do first to minimize further damage?
Select an answer first
10application · medium
A company's security team detects ransomware on a database server. The server is part of a cluster that also hosts a web application. The team suspects the ransomware may have spread to other servers in the cluster. What should the team do first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CERTIFIED-CYBER-RESILIENCY-EXPERT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by NetApp. “CERTIFIED-CYBER-RESILIENCY-EXPERT” is a trademark of its owner, used for identification only.