CFR-410 Exam Results

Offsite backups provide the best chance for data recovery after a ransomware attack. Since the critical documents and files are encrypted, having backups stored in a secure offsite location allows the organization to restore the files without having to rely on paying the ransom or trying to recover the data from the compromised system.

According to SANS, an incident retrospective should be performed no later than two weeks from the end of the incident. This allows the team to review the response, identify lessons learned, and improve future incident handling while the details are still fresh.

Log aggregation refers to the process of collecting logs from multiple sources across an IT infrastructure and centralizing them in a single platform for review and analysis. This helps simplify monitoring and enhances the ability to detect and respond to security events.