hardMultiple Choice
CISM Practice Question: Has just recovered from a ransomware attack and…
An organization has just recovered from a ransomware attack and restored systems from backups. Before returning to normal operations, what is the MOST important step?
⚠ Common exam trap
A common mix-up: candidates confuse the urgency of stakeholder notification or root cause analysis with the immediate operational necessity of validating system integrity and security before resuming business operations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Test the restored systems to ensure functionality and security.
After recovering from a ransomware attack and restoring systems from backups, the most critical step is to test the restored systems for both functionality and security. This ensures that the backups are clean (free of malware), that system integrity is verified, and that no residual threats remain before returning to normal operations. Without this validation, the organization risks re-infection or operational failures that could undermine the entire recovery effort.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Update the incident response plan.
Why it's wrong here
Revising documentation is a post-incident activity performed after operations resume, not a precondition for them. It tempts because lessons-learned updates genuinely strengthen future response, yet the stem asks what must happen before normal operations, which is verifying restored systems are free of residual attacker access.
- ✓
Test the restored systems to ensure functionality and security.
Why this is correct
Testing restored systems verifies both functionality and security before normal operations resume. Untested restores may harbour dormant malware, missed patches or corrupted data, so validation confirms the environment is genuinely clean and fit for production use.
- ✗
Notify stakeholders.
Why it's wrong here
Communication can wait until systems are confirmed safe.
- ✗
Conduct a root cause analysis.
Why it's wrong here
Root cause analysis is valuable but follows containment; returning to operations before eradicating the initial access vector, patching it, and validating backups risks immediate reinfection. It is tempting because understanding the cause feels fundamental, and it would be correct once containment and remediation are confirmed complete.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 924-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.