Ransomware Backup Recovery Strategy
Disaster Recovery and Continuity
Answer
Correct answer: B — Daily full backups stored on premises in magnetic offline media ensure data integrity and fast recovery by isolating backups from network-based ransomware attacks.
The Chief Information Security Officer of an organization needs to ensure recovery from ransomware would likely occur within the organization's agreed-upon RPOs and RTOs. Which of the following backup scenarios would best ensure recovery?
ransomware backup strategy
offline magnetic media backup
sy0-601 disaster recovery
full vs incremental backup
Community Votes
71% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Tests the understanding that online networked storage (SAN/NAS/Cloud) remains vulnerable to ransomware, making offline immutable copies the only secure choice for recovery assurance.
To ensure recovery from ransomware within RPOs and RTOs, offline storage is critical to prevent encryption of backups. Daily full backups on magnetic offline media provide the fastest restoration time among the options.
Many candidates choose cloud or SAN options thinking they are 'safer' or faster, failing to realize that connected storage allows ransomware to encrypt backup data just as easily as production data.
Community Discussion (16 comments)
NolanR
👍 13
Selected: B
Its B guys. Just took the test, and a 2 week course where this exact question came up.
caseymd85
👍 7
Selected: C
I belive it is either B or C. the others are susceptible to the attack. Honestly there isnt enough information given to determine the correct response. We need to know what their acceptable RTO and RPO are to make the correct decision.
spearous
👍 2
Selected: B
i vote for B. because it says "best ensure"; but no full backup is hard, and though it is possible via differential/incremental, it is not "best ensure".
65333d6
👍 4
This is a stupid question. It lacks necessary information regarding the RPO & RTO to direct a more accurate response
BD69
👍 1
Selected: B
It's either B or D, A&C don't have full backups (pay attention) Because it's a ransomware attack and may have moved around the network, the NAS drive could be infected or be a carrier of an infection. A tape drive is offline, so it's isolated from potential infection.
xihjr
👍 2
for a differential backup to work, a full backup is required but for some odd ball reason, the cloud provider is only maintaining the differential and not the full. if the full backup is lost the differential on the cloud would be useless
slapster
👍 4
Selected: B
It has to be B here. Piggybacking off of some other explanations, A and C can be eliminated because they lack full backups. D can be eliminated because the backups are stored on a Network-Attached Storage (NAS) device. CompTIA outlines the difference between online and offline backups, specifically referencing cryptoransomware as a factor for choosing offline. Section 20B: "An online system is faster, but an offline backup offers better security. Consider the case of cryptoransomware, for instance. If the backup system is connected to the infected host, the ransomware will encrypt the backup, rendering it useless. Some cryptoransomware is configured to try to access cloud accounts and encrypt the cloud storage."
qwes333
👍 3
Selected: B
Can't be A or C as you MUST have a Full backup as a base for the next jobs. Daily Full are probably the best choice.
[Removed]
👍 3
Selected: B
B is the only one that makes sense here. Full = fast recovery, and offline is what you want when dealing with ransomware. Comptia docs focus on 3rd party cloud backups examples of Amazon's Glacier, where it's slow and costly to recover, so C is out. D is incremental = slower than full. And for A, diff hourly doesn't address anything other than telling me a connected backup could still be impacted by the ransomware attack.
7308365
👍 2
-I would definitely cancel out A and C. -B would take a very long time to backup daily before any ransomware attack occurred, however, I believe it would achieve the company RTO AND RPO after the fact. -D would achieve RPO because say the event happened on Wednesday, you'd use your last full backup plus Monday and Tuesday and be okay. However, with it being stored on the NAS drive, it makes me worried that it might get infected too..So maybe it doesn't achieve either in that case. If it is infected it definitely doesn't achieve RPO and with how time consuming doing the full backup the then every daily backup until before the event occurred, it would not achieve RTO either -I think I'm going to lock in on B.
Benrosan
👍 2
Selected: C
C seems like the best option as the user would only need to latest full backup and most recent differential backups to get things up and running. Only problem is: we don't know if a full backup has been conducted.
Yomzie
👍 3
Both SAN (Storage Area Network) and NAS (Network Attached Storage) are highly susceptible to ransomware. Secondly, differential backup to a cloud, would not guarantee acceptable RPO. So, a non-networked Full Database backup will guarantee acceptable RPO and reasonable RTO (however long the recovery time might eventually be).
johnabayot
👍 3
Selected: B
This is because magnetic offline media, such as tapes, are not connected to the internet or local networks, and thus are immune to ransomware attacks. Daily full backups also ensure that the data is as close to real time as possible, minimizing the data loss and downtime. Storing the backups on premises also reduces the risk of data theft or leakage by third parties.
Eikan
👍 2
Selected: D
All in favor of D say aye!
Hs1208
👍 3
Selected: C
Daily differential backups maintained by a third-party cloud provider (Option C)
icebreak
👍 1
Selected: D
gota be weekly full back up. backing up in offline media will increase the time for recovery
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option B is the correct answer because it combines two essential elements for ransomware resilience: a base Full backup and physical isolation (offline media). A daily full backup ensures that the most recent state of data is available without needing to chain multiple incremental or differential files, which speeds up recovery (meeting RTO). Storing this on magnetic offline media (like tapes) ensures the backups are not connected to the network, rendering them immune to ransomware propagation.Why the Other Options Are Wrong
Options A and D rely on online storage (SAN and NAS), which are connected to the network and susceptible to being encrypted by ransomware. Option C uses a third-party cloud provider; while off-site, many cloud integrations remain accessible via API or network mounts, allowing ransomware to spread if credentials are compromised. Furthermore, differential backups require the last full backup to restore, adding complexity and potential points of failure compared to standalone full backups.Community Comment Notes
Community consensus strongly supports B, with users noting that offline media is the only way to guarantee immunity against active attacks. Several commenters emphasized that online storage like SAN and NAS is too risky in a ransomware scenario. Some learners questioned the lack of specific RPO/RTO numbers, but agreed that offline full backups are the standard best practice for this exam objective.Exam Strategy
When seeing 'ransomware' and 'backup', immediately eliminate any option involving online/networked storage (NAS, SAN, mapped drives). Look for 'offline', 'immutable', or 'air-gapped' keywords combined with frequent full backups to minimize RTO.
Frequently Asked Questions
Why is cloud backup not the best answer for ransomware?
While off-site, cloud backups often remain connected via APIs or mounts. If compromised, ransomware can encrypt them. Offline media is physically isolated.
Why not use incremental backups to save space?
Incremental backups take longer to restore because they require chaining multiple files. For strict RTO requirements, full backups are faster to recover.