A new piece of ransomware got installed on a company’s backup server which encrypted the hard drives containing the OS and backup application configuration but did not affect the deduplication data hard drives. During the incident response, the company finds that all backup tapes for this server are also corrupt. Which of the following is the PRIMARY concern?

A new piece of ransomware got installed on a company’s backup server which encrypted the hard drives containing the OS and backup application configuration but did not affect the deduplication data hard drives. During the incident response, the company finds that all backup tapes for this server are also corrupt. Which of the following is the PRIMARY concern?
A . Determining how to install HIPS across all server platforms to prevent future incidents
B . Preventing the ransomware from re-infecting the server upon restore
C . Validating the integrity of the deduplicated data
D . Restoring the data will be difficult without the application configuration

View Answer

Answer: D

Explanation:

Ransomware is a type of malware that restricts access to a computer system that it infects in some way, and demands that the user pay a ransom to the operators of the malware to remove the restriction.

Since the backup application configuration is not accessible, it will require more effort to recover the data.

Eradication and Recovery is the fourth step of the incident response. It occurs before preventing future problems.

Incorrect Answers:

A: Preventing future problems is part of the Lessons Learned step, which is the last step in the incident response process.

B: Preventing future problems is part of the Lessons Learned step, which is the last step in the incident response process.

C: Since the incident did not affect the deduplicated data, it is not included in the incident response process.

References:

https://en.wikipedia.org/wiki/Ransomware

Gregg, Michael, and Billy Haines, CASP CompTIA Advanced Security Practitioner Study Guide, John

Wiley & Sons, Indianapolis, 2012, p. 249