easyMultiple ChoiceObjective-mapped
CISM Practice Question: A small marketing firm with 50 employees…
A small marketing firm with 50 employees experiences a ransomware attack. The IT administrator quickly isolates the infected workstations by disconnecting them from the network. The company has a backup strategy that performs nightly backups to an on-premises NAS device. The administrator restores the affected systems from the most recent backup, but some files remain encrypted. The users report that the backups from the last two days show corruption as well. The firm does not have a formal incident response plan. The owner is anxious to get back to work and asks the administrator what to do next. What should the administrator do?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Restore from an older backup taken before the infection
Restoring from an older backup (before the ransomware infection occurred) is the most likely way to get clean data. Paying the ransom is not recommended as it encourages attackers and there is no guarantee. Contacting law enforcement is a good step but not the immediate technical solution. Running an antivirus scan is insufficient for decryption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Restore from an older backup taken before the infection
Why this is correct
Older backups are likely unencrypted and can be restored after verifying integrity.
- ✗
Contact law enforcement immediately
Why it's wrong here
Law enforcement should be contacted, but the priority is to restore operations using available clean backups.
- ✗
Pay the ransom to get the decryption key
Why it's wrong here
Paying ransom does not guarantee data recovery and supports criminal activities.
- ✗
Run a full antivirus scan on the restored systems
Why it's wrong here
Antivirus may detect but not decrypt files; clean backup restoration is needed.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 871 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CISM
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An organization has just experienced a ransomware attack that encrypted files on several file servers. The incident response team has contained the incident. What is the next critical step?
easy- A.Pay the ransom to recover data.
- B.Wipe the affected servers and reimage them.
- C.Notify law enforcement.
- ✓ D.Restore files from clean backups.
Why D: Restore files from clean backups, as this is the most reliable recovery method after containment. Paying the ransom is discouraged and does not guarantee data recovery; notifying law enforcement can be done later; wiping and reimaging may be unnecessary if clean backups are available.
Variation 2. A company experiences ransomware that encrypts critical servers. Backups are available but were taken 2 weeks ago. What is the best course?
medium- A.Restore from backups immediately
- ✓ B.Restore from backups after verifying no residual malware and performing security scans
- C.Rebuild servers from scratch
- D.Pay the ransom
Why B: Restore from backups after verifying no residual malware and performing security scans to ensure clean restoration.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.