ISC2 CC Business Continuity, DR & Incident Response Practice Question
A healthcare organization experiences a ransomware attack that encrypts all files on file servers and workstations. The incident response team has isolated the infected systems. The backup policy includes daily incremental backups and weekly full backups stored on a separate network segment. The most recent full backup is 5 days old. The incremental backups from the past 4 days are available but are stored on the same backup server that might be compromised. To restore data with minimal loss, what should the team do?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
First verify the integrity of the backups by scanning them on an isolated system, then restore the full backup and apply the most recent clean incremental backups.
The first step should be to verify the integrity of the backups by scanning them on an isolated system, because the backup server might be compromised. If the backups are clean, restore the full backup (5 days old) and then apply the most recent clean incremental backups from the past 4 days. This minimizes data loss while ensuring no ransomware is reintroduced. Option A is risky because if the incremental backup contains ransomware, restoring it directly would reinfect systems. Option B rebuilds from scratch and would lose all data changes from the past 5 days, which is more drastic than necessary. Option D assumes all incremental backups are safe without verification and incorrectly includes 5 days of increments when only 4 are available (the most recent full backup is 5 days old, so increments cover days 1-4).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the most recent incremental backup to restore files directly.
Why it's wrong here
Incremental backups alone are not enough; full backup needed.
- ✗
Assume all backups are compromised and rebuild systems from scratch.
Why it's wrong here
Unnecessary if backups are clean; data loss would be greater.
- ✓
First verify the integrity of the backups by scanning them on an isolated system, then restore the full backup and apply the most recent clean incremental backups.
Why this is correct
Ensures clean backups and minimal data loss.
- ✗
Restore the weekly full backup and then apply all incremental backups from the past 5 days.
Why it's wrong here
Risks restoring ransomware if backups are compromised.
Go deeper
Related to this question
Learn chapter
Network Security Foundations
Key term
Ransomware
Ransomware is a type of malicious software that encrypts a victim's files or locks them out of their system, demanding payment, usually in cryptocurrency, to restore access.
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
About these practice questions
Courseiva writes every CC question from scratch — 976 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.