Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5
mediumDrag & DropObjective-mapped
ISC2 CC Practice Question: Drag and drop the steps to recover a system from…
Drag and drop the steps to recover a system from a verified backup after a ransomware attack into the correct order.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Step 1: Isolate the infected system, Step 2: Wipe the infected system, Step 3: Restore data from the verified backup, Step 4: Scan the restored system for malware.
Recovery requires isolation, backup verification, wiping, restoration, and scanning.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Step 1: Isolate the infected system, Step 2: Wipe the infected system, Step 3: Restore data from the verified backup, Step 4: Scan the restored system for malware.
Why this is correct
This is the correct order because you must first isolate the system to prevent further spread, then wipe it to remove all malware, restore from a clean backup, and finally scan to ensure no remnants remain.
- ✗
Step 1: Wipe the infected system, Step 2: Isolate the infected system, Step 3: Restore data from the verified backup, Step 4: Scan the restored system for malware.
Why it's wrong here
This is incorrect because wiping before isolation can allow malware to propagate over the network during the wipe process.
- ✗
Step 1: Isolate the infected system, Step 2: Restore data from the verified backup, Step 3: Wipe the infected system, Step 4: Scan the restored system for malware.
Why it's wrong here
This is incorrect because restoring data before wiping the system would reintroduce the malware onto the newly restored files.
- ✗
Step 1: Scan the infected system, Step 2: Isolate the infected system, Step 3: Wipe the infected system, Step 4: Restore data from the verified backup.
Why it's wrong here
This is incorrect because scanning should occur after restoration to check for any residual threats, not before isolation.
Go deeper
Related to this question
Learn chapter
Business Continuity and Disaster Recovery
Key term
Ransomware
Ransomware is a type of malicious software that encrypts a victim's files or locks them out of their system, demanding payment, usually in cryptocurrency, to restore access.
Key term
Isolation
Isolation is the process of separating a compromised or suspicious system from a network to prevent the spread of malware or unauthorized access.
About these practice questions
Courseiva writes every CC question from scratch — 976 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.