Skip to content
AI Security

Interview question · Detection Engineering & Incident Response

Ransomware operators go after backups first. How do you design backups that survive an attacker with domain admin, and prove they restore?

Having backups is not the control; having backups an attacker with admin rights cannot delete, and restoring from them on schedule, is. The scored answer designs for both.

mediumNewPreparation tags: Microsoft, Amazon, GoogleUpdated Nov 2026

Having backups is not the control; having backups an attacker with admin rights cannot delete, and restoring from them on schedule, is. The scored answer designs for both.

Make your first attempt

What would you say before reading the answer?

  1. 01 State the assumptions your answer depends on.
  2. 02 Explain the mechanism and choose a control.
  3. 03 Name a condition that would change your decision.

The worked answer includes an approach, scoring criteria and follow-up questions. Compare the reasoning with your own.

10 answers per topic instead of 5, plus saved progress and bookmarks · costs nothingor unlock all 529 remaining answers · $25

Every worked answer in all 17 topics, every lesson in every course, the full concept curriculum, the complete practice-test bank, and the downloadable security field guides.

6 months · One payment · No auto-renewal

What if · the follow-ups in this answer

The answer works through 4 follow-ups like an interviewer would

A company is hit by ransomware. Production is encrypted. Its backup server, which was joined to the Windows domain, shows all backup jobs deleted two days before encryption. A copy also went to cloud object storage with Object Lock in governance mode.

  1. Can you count on the cloud copy?
  2. The cloud copies survived. Which restore point do you use?
  3. What do you change so this does not repeat?
  4. How do you summarise ransomware-resistant backups?

Each rung has a nudge, a model answer, the principle that carries over and the weak answer to avoid. Premium opens every answer and ladder.

UP NEXT ON YOUR JOURNEY
Next in this trackHow does one infostealer infection on a personal laptop become a breach of your company, and what breaks that chain?Next in this trackSome malware now asks an AI model what to do at run time. What is real so far, and how should detection and response change?Next in this trackYour SIEM receives normal log volume but stops correlating sensitive reads. How would you investigate?
DISCUSSION · 0

No comments yet. Share a correction or a different way to answer it.