easyMultiple Choice
CISSP Practice Question: Is a key requirement for an effective backup…
Which of the following is a key requirement for an effective backup strategy to ensure data can be recovered after a ransomware attack?
⚠ Common exam trap
The trap is assuming that any backup is sufficient for ransomware recovery; the exam expects you to recognize that isolation (offline/air-gapped) and encryption, not just frequency or location, are what make backups ransomware-resistant.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Backups are encrypted and stored offline or air-gapped.
For ransomware resilience, backups must be isolated from the production environment so that malware cannot encrypt or delete them along with production data. Encrypting backups and storing them offline or air-gapped ensures that even if attackers compromise the network and credentials, the backup copies remain intact and recoverable. This directly addresses the ransomware threat model where attackers target connected backups first.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Incremental backups are performed monthly.
Why it's wrong here
Monthly incremental backups are highly ineffective for most operational environments, as they result in an unacceptably high Recovery Point Objective (RPO). This infrequent schedule means that in the event of a system failure or data corruption, up to a full month's worth of data changes could be permanently lost, leading to severe business disruption. Modern best practices typically require daily or even more frequent backups to minimize potential data loss.
- ✗
Backups use the same credentials as the production environment.
Why it's wrong here
Using identical credentials for both production systems and backup repositories creates a critical single point of failure and a severe security vulnerability. If an attacker compromises the production environment's credentials, they gain immediate access to the backups, enabling them to delete, encrypt, or exfiltrate critical recovery data. This practice undermines the entire disaster recovery strategy and violates the principle of least privilege and separation of duties.
- ✗
Backups are stored on the same network as production.
Why it's wrong here
Storing backups on the same network as the production environment significantly increases the risk of simultaneous compromise. A network-wide attack, such as ransomware or a sophisticated worm, could easily propagate to and encrypt or delete both live data and its corresponding backups, rendering recovery impossible. Effective backup strategies demand logical and physical separation to ensure resilience against such widespread threats.
- ✓
Backups are encrypted and stored offline or air-gapped.
Why this is correct
Encrypting backups protects data confidentiality both in transit and at rest, preventing unauthorized access even if the storage media is compromised. Storing these encrypted backups offline or in an air-gapped manner physically isolates them from the production network, making them impervious to network-borne threats like ransomware, malware, or insider attacks that target online data. This strategy ensures data immutability and provides a secure, last-resort recovery point.
Go deeper
Related to this question
Learn chapter
Asset Security: Privacy and Data Retention
Key term
Threat
A threat is any potential danger that could harm a computer system, network, or data, whether from a malicious hacker, a natural disaster, or an accidental mistake.
Key term
Malware
Malware is any software intentionally designed to cause damage, disrupt operations, steal data, or gain unauthorized access to computer systems.
About these practice questions
One of 816 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.