A company's file server was infected with ransomware, and all files were encrypted. The IT team has daily backups stored on a separate network-attached storage (NAS) appliance. However, the backups were also encrypted because the backup service account had full write permissions to the NAS share. The backup account was a domain administrator account. Which of the following should the organization implement to BEST prevent this scenario from recurring?

Create a separate backup service account with limited privileges and disable interactive logon

While least privilege is important, a backup account still needs write access to the backup location. If ransomware compromises that account, it could still encrypt backups. This alone does not fully prevent the recovery scenario.

Require multifactor authentication for access to the backup repository

MFA adds a layer of security for authentication, but if the ransomware runs with the backup service account's token, it may not need to reauthenticate. MFA does not protect against modification of data using already-stolen credentials.

Encrypt backup data at rest using BitLocker or similar technology

Encryption protects data confidentiality but does not prevent ransomware from encrypting (or re-encrypting) the data. The goal is to ensure backups remain recoverable, not just secured from prying eyes.

What does this 220-1101 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Use immutable backup storage that enforces write-once, read-many (WORM) policies — The root cause is that the backup storage was writable by a privileged account, allowing ransomware to encrypt backups as well. Implementing immutable backups (write-once, read-many or WORM storage) prevents ransomware from modifying or deleting backup data even with administrative credentials. Creating a separate backup account with limited privileges is good, but if the account has write access, ransomware running with those privileges could still encrypt the backups. MFA and encryption at rest are valuable but do not prevent modification of backup data by an attacker with valid credentials.

What should I do if I get this 220-1101 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.