Question

A financial services company is designing its ransomware resiliency strategy. During a tabletop exercise, the security architect notes that a recent industry breach began with credential theft that let attackers disable backups and encrypt domain controllers before any data was touched. Executive leadership asks the architect to identify which capability should receive the highest priority investment to reduce the likelihood that a future ransomware campaign can achieve organization-wide impact. Which recommendation best aligns with Microsoft's ransomware resiliency guidance in the MCRA?

Accepted Answer

Prioritize securing privileged access with tiered administration and phishing-resistant MFA to prevent attackers from gaining the control needed to disable backups and reach Tier 0 assets

Answer

Prioritize deploying immutable, geo-redundant backups so encrypted data can always be restored regardless of how attackers gain access

Answer

Prioritize enabling Microsoft Defender for Endpoint on all user devices to detect and block the initial malware payload

Answer

Prioritize purchasing cyber insurance and building a detailed incident response runbook to reduce financial and operational impact after an attack