Which design features support a ransomware-resilient data backup strategy?

Which design features support a ransomware-resilient data backup strategy?

• A. Backups stored on the same server
• B. Offsite/offline backups, immutable backups, regular test restores, versioning, encryption in transit and at rest, and minimal exposure windows
• C. No encryption
• D. Backups only for critical servers, not OT

Answer: (A)

Ransomware-resilient data backup design emphasizes keeping copies separate from the active environment, making them tamper-evident and readily recoverable. The best approach includes offsite or offline backups to break the attack path, immutable backups so they can’t be deleted or altered during an incident, and regular test restores to prove you can actually recover. Versioning provides multiple restore points, protecting you if some backups become corrupted. Encrypting backups in transit and at rest safeguards data integrity and confidentiality, and minimizing exposure windows reduces the chance that online backups are compromised. Storing backups on the same server creates a single point of failure—the attacker can reach both the live data and the backups in one go. No encryption leaves data exposed and susceptible to tampering, and backing up only critical servers (ignoring OT) leaves gaps in recovery capability. The combination described—offsite/offline, immutable, tested, versioned, encrypted backups with minimal exposure—is what makes a backup strategy resilient against ransomware.

Ransomware-resilient data backup design emphasizes keeping copies separate from the active environment, making them tamper-evident and readily recoverable. The best approach includes offsite or offline backups to break the attack path, immutable backups so they can’t be deleted or altered during an incident, and regular test restores to prove you can actually recover. Versioning provides multiple restore points, protecting you if some backups become corrupted. Encrypting backups in transit and at rest safeguards data integrity and confidentiality, and minimizing exposure windows reduces the chance that online backups are compromised. Storing backups on the same server creates a single point of failure—the attacker can reach both the live data and the backups in one go. No encryption leaves data exposed and susceptible to tampering, and backing up only critical servers (ignoring OT) leaves gaps in recovery capability. The combination described—offsite/offline, immutable, tested, versioned, encrypted backups with minimal exposure—is what makes a backup strategy resilient against ransomware.