CompTIA Security+ SY0-701 Practice Question
A company has been struck by a ransomware attack which has left their files encrypted. Prior to this incident, the company followed a strict data backup policy. In order to restore operations and recover from the attack, which of the following is the BEST immediate action?
Isolate the infected systems and then negotiate payment with the attackers
Pay the ransom to quickly regain access to the encrypted files
Restore from last known good backups
Rebuild the affected systems from scratch