hardMultiple ChoiceObjective-mapped
CISM Practice Question: After a ransomware attack, the incident response…
After a ransomware attack, the incident response team successfully restores systems from backups. However, the ransomware encrypts files that were modified after the last backup was taken. Which of the following is the BEST way to minimize future data loss?
⚠ Common exam trap
Many exam-takers choose 'Perform full backups daily' (Option B) thinking more frequent backups are sufficient, but they overlook that even daily backups leave a gap where modified files can be encrypted and lost, whereas CDP provides near-continuous recovery points.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use continuous data protection (CDP) with frequent snapshots.
Continuous data protection (CDP) with frequent snapshots captures every write operation in near real-time, allowing recovery to any point before the ransomware encryption. This eliminates the gap between the last backup and the attack, ensuring that even files modified after the last full backup can be restored without data loss.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Train users to save files to network drives.
Why it's wrong here
Training users to save files to network drives does not protect against ransomware encryption of those files; the files on network drives could also be encrypted if the drive is mapped, and it does not address the backup gap.
- ✗
Perform full backups daily instead of weekly.
Why it's wrong here
Daily full backups reduce the backup window but still leave a period (up to 24 hours) during which modified files can be encrypted and lost; continuous data protection offers a more granular recovery point.
- ✗
Implement a data loss prevention (DLP) system.
Why it's wrong here
Data loss prevention (DLP) systems monitor and prevent unauthorized data exfiltration, but they do not provide the ability to recover encrypted files after a ransomware attack; they address data leakage, not data loss from encryption.
- ✓
Use continuous data protection (CDP) with frequent snapshots.
Why this is correct
Continuous data protection (CDP) with frequent snapshots captures every write operation in near real-time, allowing recovery to any point before the ransomware encryption, thereby minimizing data loss from files modified after the last full backup.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 871 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.