SY0-701 Question 230
Single answer3.4 Explain the importance of resilience and recovery in security architecture.A healthcare provider was hit by ransomware that encrypted several virtual servers, including the primary file server and an on-premises backup repository that was continuously mounted to the network. Leadership now requires a redesign that will allow the organization to restore critical systems quickly even if production systems are compromised again. Which solution BEST improves both resilience and recovery in this scenario?
- A
Implement immutable, offline backups with regular restoration testing and documented recovery time objectives (RTOs) for critical systems
- B
Increase the complexity of user passwords and require changes every 30 days for all employees
- C
Deploy a network intrusion detection system (NIDS) to alert on suspicious east-west traffic between servers
- D
Enable full-disk encryption on all servers to prevent future ransomware infections
Show answer and explanation
Correct answer: A
Explanation
This question tests practical understanding of resilience and recovery in security architecture. The best answer is to implement immutable or offline backups, validate them through restoration testing, and define recovery objectives such as RTOs. These measures support business continuity by ensuring the organization can recover known-good data and restore critical services within acceptable timeframes after a destructive event such as ransomware. Industry best practices, including guidance from NIST on contingency planning and incident recovery, emphasize protected backups, recovery testing, and clearly defined recovery objectives. In contrast, password changes, NIDS deployment, and full-disk encryption may improve prevention, detection, or confidentiality, but they do not directly address the architectural recovery weakness exposed by this incident.
- A. Correct.
Correct. Immutable or offline backups directly address the failure described in the scenario: the backup repository was reachable and was affected during the ransomware event. Keeping backups offline, air-gapped, or otherwise immutable helps preserve recoverable copies even when attackers compromise production systems. Regular restoration testing is essential because backups that cannot be restored do not support recovery. Defining RTOs ensures the organization aligns backup and recovery design with business needs for critical systems, which is a core element of resilience and recovery planning.
- B. Incorrect.
Incorrect. Stronger password controls may improve preventive security posture, but they do not specifically solve the resilience and recovery problem described. The scenario focuses on restoring operations after a compromise, especially when backups were also impacted. Password complexity alone does not ensure recoverable data or faster restoration of critical services.
- C. Incorrect.
Incorrect. A NIDS can improve detection and provide earlier warning of malicious activity, which supports defense in depth, but it does not by itself provide recovery capability. The main gap in the scenario is that backups were accessible to the ransomware and recovery design was insufficient. Detection is valuable, but it is not the best answer for improving both resilience and recovery.
- D. Incorrect.
Incorrect. Full-disk encryption protects data at rest from unauthorized access if a device or storage medium is lost or stolen. It does not prevent ransomware from encrypting files through legitimate system access after compromise. This is a common misconception: data-at-rest encryption is not a recovery control and does not replace backup resiliency measures.