Courseiva
← CISM
Full test
easyMultiple ChoiceObjective-mapped

CISM Practice Question: Has just experienced a ransomware attack that…

An organization has just experienced a ransomware attack that encrypted files on several file servers. The incident response team has contained the incident. What is the next critical step?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Restore files from clean backups.

Restore files from clean backups, as this is the most reliable recovery method after containment. Paying the ransom is discouraged and does not guarantee data recovery; notifying law enforcement can be done later; wiping and reimaging may be unnecessary if clean backups are available.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    Pay the ransom to recover data.

    Why it's wrong here

    Incorrect: Encourages attackers and may not yield decryption.

  • ✗

    Wipe the affected servers and reimage them.

    Why it's wrong here

    Incorrect: Unnecessary if backups are available.

  • ✗

    Notify law enforcement.

    Why it's wrong here

    Incorrect: Important but not immediate recovery step.

  • ✓

    Restore files from clean backups.

    Why this is correct

    Correct: Efficient recovery without paying ransom.

About these practice questions

Courseiva writes every CISM question from scratch — 871 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.