Disaster Recovery

Correct Answer: Use a satellite Internet connection or similar emergency communication channels.

Using a satellite Internet connection ensures critical operations can continue, whereas temporary servers on site would still be dependent on local connectivity. Relying on personal Internet or cellphone hotspots may not provide adequate security or bandwidth. Waiting for connectivity restoration might result in delays and losses. Moving the entire company is impractical.

Correct Answer: Isolate affected systems

The best first step in the disaster recovery process during a ransomware attack is to isolate affected systems. This is crucial because:

1. It prevents the ransomware from spreading further within the network.
2. It limits the potential damage and data loss.
3. It allows security teams to assess the situation and develop a recovery plan.

Restoring from backup immediately is not the best first step because it could potentially reinfect clean systems if the backup is contaminated or if the source of the infection hasn't been identified and removed.

Paying the ransom is generally not recommended as it doesn't guarantee data recovery and may encourage further attacks.

Running antivirus software on all systems is not the immediate priority and may not be effective against advanced ransomware. It's more important to isolate the affected systems first before attempting any remediation steps.

By isolating affected systems first, the organization can contain the threat, assess the damage, and then proceed with subsequent recovery steps in a controlled manner.

Correct Answer: Shutting down and transferring critical servers to higher ground.

Shutting down and transferring critical servers to higher ground helps to minimize damage and potential loss. Immediate evacuation would leave the servers in danger, while patching leaks only mitigates the damage for a short time. Replacing non-critical servers and checking the layout don't address the immediate risk, and developing a disaster recovery plan should have been done before the disaster.