hardMultiple ChoiceObjective-mapped
CISM Practice Question: Has just recovered from a ransomware attack and…
An organization has just recovered from a ransomware attack and restored systems from backups. Before returning to normal operations, what is the MOST important step?
⚠ Common exam trap
A common mix-up: candidates confuse the urgency of stakeholder notification or root cause analysis with the immediate operational necessity of validating system integrity and security before resuming business operations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Test the restored systems to ensure functionality and security.
After recovering from a ransomware attack and restoring systems from backups, the most critical step is to test the restored systems for both functionality and security. This ensures that the backups are clean (free of malware), that system integrity is verified, and that no residual threats remain before returning to normal operations. Without this validation, the organization risks re-infection or operational failures that could undermine the entire recovery effort.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Update the incident response plan.
Why it's wrong here
Post-incident review; not immediate.
- ✓
Test the restored systems to ensure functionality and security.
Why this is correct
Critical to confirm no residual malware or misconfiguration.
- ✗
Notify stakeholders.
Why it's wrong here
Communication can wait until systems are confirmed safe.
- ✗
Conduct a root cause analysis.
Why it's wrong here
Important but not before verifying systems.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.