SY0-701 Question 231
Select 33.4 Explain the importance of resilience and recovery in security architecture.A healthcare organization recently suffered a ransomware attack that encrypted several on-premises file servers. The company was able to restore some data, but recovery took several days because the backups were connected to the network and some backup sets were also corrupted. Leadership has asked the security team to redesign the environment to improve resilience and recovery while minimizing the chance that a future attack will disrupt patient care. Which THREE actions should the security team take?
- A
Implement immutable or offline backups and regularly test restoration procedures
- B
Deploy geographic redundancy for critical systems and data
- C
Rely primarily on RAID for backup and disaster recovery needs
- D
Create and maintain a documented disaster recovery and business continuity plan with defined RTOs and RPOs
- E
Increase password complexity requirements for end users as the primary recovery control
Show answer and explanation
Correct answers: A, B, D
Explanation
The best answers are implementing immutable or offline backups with restoration testing, deploying geographic redundancy, and maintaining a DR/BC plan with defined RTOs and RPOs. Together, these controls address both resilience and recovery: protected backups preserve recoverable data, geographic redundancy supports continuity of operations, and formal planning ensures recovery aligns with business and patient-care requirements. This reflects widely accepted best practices from NIST contingency planning guidance, such as NIST SP 800-34 (Contingency Planning Guide for Federal Information Systems), and guidance on ransomware resilience that emphasizes isolated backups, tested recovery, and continuity planning. RAID is useful for hardware fault tolerance but does not replace backup or recovery capabilities, and password complexity is primarily a preventive authentication measure rather than a resilience or recovery architecture control.
- A. Correct.
Correct. Immutable backups and offline backups are key resilience controls against ransomware because they reduce the likelihood that malware can encrypt or delete backup data. Just as important, regularly testing restoration procedures validates that backups are usable and that staff can meet recovery objectives during an incident. A common mistake is assuming that having backups alone is sufficient without verifying recoverability.
- B. Correct.
Correct. Geographic redundancy improves availability and recovery by ensuring critical services and data can fail over or be restored from another location if a site is impacted by ransomware, natural disaster, or infrastructure failure. This is a core resilience design principle for organizations that need continuity of operations, especially in healthcare where downtime can affect patient care.
- C. Incorrect.
Incorrect. RAID provides fault tolerance and availability for disk failures, but it is not a substitute for backups or disaster recovery. If ransomware encrypts data, RAID will typically replicate the encrypted state across the array. Candidates often confuse redundancy with backup, but RAID does not provide versioned, isolated recovery points.
- D. Correct.
Correct. A documented disaster recovery (DR) and business continuity (BC) plan with defined recovery time objectives (RTOs) and recovery point objectives (RPOs) is essential for resilience and recovery. These plans help the organization prioritize systems, set acceptable downtime and data loss thresholds, and align technical recovery capabilities with business requirements. Without defined objectives, recovery efforts are often inconsistent and too slow.
- E. Incorrect.
Incorrect. Stronger passwords can improve preventative security, but they are not a primary recovery control. The scenario specifically focuses on resilience and recovery after a disruptive event. Password complexity does not address protected backups, alternate processing locations, restoration testing, or recovery planning. Someone might choose this option because it sounds security-related, but it does not solve the recovery weaknesses described.