ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Restoring a clean environment after ransomware requires that backups be treated as potentially contaminated until proven safe. The most secure method is to create new, isolated resources from the latest immutable snapshot, perform an offline malware scan, and patch the system before connecting it to production networks. This keeps the original compromised instance and volumes untouched for forensic analysis, maintains chain of custody, and avoids the risk of immediately re-infecting production. Re-attaching restored volumes to the still-compromised instance or performing in-place restores could allow dormant malware to reactivate. Launching the instance directly into the production VPC before validation also risks lateral spread. Exporting snapshots off-cloud adds complexity and delays recovery without providing additional security benefits compared with scanning in an isolated AWS account/VPC.