SSCP Incident Response and Recovery Practice Question
An organization has suffered a ransomware attack that encrypted files on several file servers. The incident response team is planning recovery. Which TWO actions should be performed to verify that the restored systems are clean before returning them to production? (Select TWO)
⚠ Common exam trap
A common mix-up: candidates assume restoring from a clean backup (Option A) is sufficient to guarantee a clean system, but the SSCP exam emphasizes that backups must be verified as malware-free and that additional validation steps (scanning and monitoring) are required before returning systems to production.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Run a full antivirus and anti-malware scan on the restored systems
Running a full antivirus and anti-malware scan on the restored systems ensures that no remnants of the ransomware (e.g., dormant payloads, modified registry keys, or backdoor executables) remain in the restored data. Even if the backup was taken before the infection, the restore process could reintroduce malware if the backup itself was compromised or if the ransomware had persisted in the system state. A thorough scan validates that the restored environment is free of known malicious signatures and behavioral indicators.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Restore the systems from the most recent backup
Why it's wrong here
Restoring is part of recovery, not verification.
- ✗
Change all user passwords associated with the systems
Why it's wrong here
Password reset is an eradication step, not a verification step.
- ✓
Run a full antivirus and anti-malware scan on the restored systems
Why this is correct
Scanning ensures no malware remains in the restored data.
- ✗
Apply all security patches to the operating system
Why it's wrong here
Patching is important but does not verify cleanliness; it prevents future exploits.
- ✓
Monitor the systems for any signs of reinfection or anomalous behavior for a period of time
Why this is correct
Monitoring helps detect if the malware persists or if the system is compromised again.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 920 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.