SY0-701 Question 247
Single answerBackups: Onsite/offsite , Frequency , Encryption , Snapshots , Recovery , Replication , JournalingA company is hit by ransomware at 3:00 p.m. on Wednesday. The security administrator confirms the malware began encrypting files at 2:15 p.m. The organization has the following data protection setup for its primary file server: hourly local snapshots retained for 48 hours, nightly encrypted backups replicated to an offsite location, and quarterly recovery testing. Management wants file services restored as quickly as possible while minimizing data loss and ensuring backup data remains protected if copied offsite. Which action should the administrator take FIRST?
- A
Restore the most recent offsite backup from Tuesday night because offsite backups are more secure than onsite copies
- B
Roll back the file server to the 2:00 p.m. local snapshot and then validate file integrity before resuming access
- C
Use the replicated offsite backup set and disable encryption so the restore completes faster
- D
Wait for the next nightly backup cycle to finish, then restore from the newest backup to ensure consistency
Show answer and explanation
Correct answer: B
Explanation
The best answer is to restore from the 2:00 p.m. local snapshot because it provides the fastest recovery and the least data loss while using a recovery point known to predate the ransomware activity. This reflects standard business continuity and disaster recovery principles: use the recovery method that best meets RTO and RPO requirements. Snapshots are commonly used for rapid local recovery, while encrypted offsite backups and replication support resilience if local systems are unavailable, destroyed, or also compromised. Encryption of backups is a best practice to protect confidentiality for stored backup media and replicated copies, especially offsite. Recovery testing is also important because organizations should regularly verify that restoration procedures work as expected. These practices align with common industry guidance such as NIST recommendations for contingency planning and backup protection, including maintaining protected backups, using geographically separate copies, and regularly testing recovery procedures.
- A. Incorrect.
This is incorrect. Offsite backups are important for resilience against site loss and are often part of disaster recovery planning, but restoring from Tuesday night would create significantly more data loss than necessary. In this scenario, the organization has hourly local snapshots, which are designed for fast recovery from recent incidents such as accidental deletion, corruption, or ransomware discovered quickly. Choosing the offsite backup first confuses backup location security with the best recovery point objective (RPO) and recovery time objective (RTO) for the incident.
- B. Correct.
This is correct. Because the encryption activity started at 2:15 p.m., the 2:00 p.m. snapshot is the latest known-good recovery point before compromise. Local snapshots are typically the fastest option for restoring service because they avoid transferring large backup sets from an offsite repository. This approach minimizes downtime and limits data loss to roughly one hour or less, depending on workload. Validating integrity before reopening access is also important to confirm the snapshot was not affected and that restored data is usable.
- C. Incorrect.
This is incorrect. Replicated offsite backups are valuable if the primary site or local recovery mechanisms are unavailable, but they are not the best first choice here because they are slower and would likely result in more data loss than the 2:00 p.m. snapshot. Disabling encryption is also a poor practice; backup encryption protects confidentiality, especially for offsite storage and data in transit, and should not be removed to speed recovery unless there is a very specific, approved exception. This option mixes a valid concept (replication) with an insecure action (removing encryption).
- D. Incorrect.
This is incorrect. Waiting for the next backup cycle would delay recovery and could worsen the incident. It also risks backing up already encrypted or otherwise corrupted data if protections are not in place. Best practice is to stop the spread of ransomware, identify the last known-good restore point, and recover from that point as quickly as possible. Backup consistency matters, but deliberately delaying restoration when a viable pre-incident snapshot exists is not appropriate.