Question

A ransomware incident has been fully contained and eradicated across the affected file servers. The IR team is now beginning the recovery phase and plans to restore data from backups taken two days before the infection. Before bringing the restored systems back into production, which action is MOST important to perform?

Accepted Answer

Scan and validate the restored data and systems to confirm they are free of malware and integrity is intact before reconnecting to production

Answer

Immediately reconnect the restored servers to the production network to minimize business downtime

Answer

Delete all backups older than the restore point to prevent accidental reintroduction of infected data

Answer

Draft the lessons-learned report and schedule the post-incident review meeting