A small business just recovered from a ransomware attack against its file servers by purchasing the decryption keys from the attackers. The issue was triggered by a phishing email and the IT administrator wants to ensure it does not happen again. Which of the following should the IT administrator do FIRST after recovery?
A) Scan the NAS for residual or dormant malware and take new daily backups that are tested on a frequent basis.
B) Restrict administrative privileges and patch all systems and applications.
C) Rebuild all workstations and install new antivirus software.
D) Implement application whitelisting and perform user application hardening.

Question

Quizplus · Accepted Answer

The IT administrator should first ensure that there is no residual or dormant malware on the network by scanning the NAS and then establish a reliable backup system to prevent data loss in future incidents.

A Small Business Just Recovered from a Ransomware Attack Against