During ransomware containment, why is it important that backups be offline?

• A. To prevent backups from being encrypted by the ransomware.
• B. To increase backup speed
• C. To ensure backups are always online
• D. To prevent backups from being used for testing

Answer: (A)

When ransomware containment is in play, backups must be offline to stay safe from the attack. Keeping backups disconnected from the network or stored on removable media that isn’t mounted means the malware cannot reach them to encrypt or tamper with them. This air-gapped setup preserves clean restore points, allowing you to recover systems from a known good state after the incident. Testing and verification of those backups should still be done, but the core protection during containment is that offline backups are immune to the encryption that the ransomware is deploying.

The other options don’t fit the scenario: offline status doesn’t inherently speed up backup; making backups always online would expose them to encryption; and the idea of keeping backups from testing isn’t relevant to safeguarding recoverability during an attack.