What Steps Must Be Performed Before Restoring Data from Backup After Ransomware?
An organization is restoring a critical database from a backup after a ransomware attack. Which of the following steps should be performed BEFORE restoring the data to ensure the restoration is successful and secure?
Quick Answer
Verifying the backup's integrity and patching the exploited vulnerability both need to happen before restoration because a ransomware recovery can fail in two very different ways, and this answer addresses both. First, ransomware attacks sometimes reach backup systems too, so a backup that looks available might actually be corrupted, incomplete, or even quietly encrypted itself; checking it with something like a checksum comparison or a test restore confirms the data you're about to bring back is actually clean and usable. Second, if the original vulnerability that let the attacker in is never patched, restoring the exact same environment simply reopens the same door, and the newly restored system can be re-compromised or re-encrypted almost immediately. Neither step alone is sufficient: a verified, clean backup restored onto a still-vulnerable system is just as much a failure as patching a system and then restoring corrupted data onto it. Together they represent the two halves of a secure recovery, confirming what you're restoring is trustworthy and confirming the environment you're restoring it into won't immediately be compromised again. When a scenario asks what must happen before a post-incident restoration, look for an answer that covers both the integrity of the data being restored and the security gap that caused the incident in the first place.
⚠ Common exam trap
Watch out — candidates often assume restoring the most recent backup is always the priority, but the SSCP exam emphasizes that verifying backup integrity and securing the environment against re-infection are mandatory prerequisites for a successful and secure recovery.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify the integrity of the backup and patch the exploited vulnerability
Verifying backup integrity (e.g., using checksums or restore tests) ensures the backup is not corrupted or incomplete, which is critical after a ransomware attack where backups may also be targeted. Patching the exploited vulnerability (e.g., applying a security update or disabling the vulnerable service) prevents re-infection during or after the restore, ensuring the recovery is secure. Without these steps, restoring a compromised or incomplete backup could lead to data loss or immediate re-encryption by the same ransomware.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Notify users that the system will be available in one hour
Why it's wrong here
Notifying users addresses availability expectations, not restoration integrity. Before restoring, the organisation must confirm the backup itself is free of malware and that the infection is eradicated, otherwise reinfection occurs. User notification belongs to change communication, typically issued once a clean restore point is verified.
- ✗
Disconnect the backup server from the network
Why it's wrong here
Isolating the backup server prevents re-infection during restore, but the question asks what must happen before restoring data to the production database itself. Disconnecting the backup host is a containment measure for the backup infrastructure, not a prerequisite for validating the restore target's integrity or confirming the backup is malware-free.
- ✗
Immediately restore the most recent backup to minimize data loss
Why it's wrong here
Restoring the newest backup immediately risks reintroducing ransomware if that backup was created after infection. The stem requires verifying backup integrity and scanning for malware first. Speed of recovery is the goal in a routine hardware failure, where the latest backup is trusted; here trust must be established before any restore.
- ✓
Verify the integrity of the backup and patch the exploited vulnerability
Why this is correct
Validating backup integrity confirms the data is uncorrupted and restorable, while patching the exploited vulnerability prevents immediate re-infection during restoration. Both must precede the restore to satisfy the stem's requirement that restoration be successful and secure.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SSCP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An organization has experienced a ransomware attack. After containing the incident, the response team plans to restore systems from backups. Which step is most critical before restoring production systems?
medium- A.Verify the integrity of backup data by restoring to an isolated test environment.
- B.Notify law enforcement immediately.
- ✓ C.Patch the exploited vulnerability and ensure the backup is free of malware.
- D.Disconnect all systems from the network.
Why C: Restoring from backups while the original vulnerability remains unpatched would allow the ransomware to reinfect the systems immediately. Additionally, if the backup itself contains malware (e.g., the ransomware encrypted the backup repository), restoring it would reintroduce the infection. Patching the exploited vulnerability and verifying the backup is clean ensures a safe restoration point, breaking the attack chain.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.