Skip to content

ACCA Applied Knowledge · Business and Technology · Financial systems and technology

Hamid Ltd discovers that ransomware has encrypted its servers and the attacker demands payment for the decryption key. The company has daily offline backups tested last week. Which statement is the most appropriate assessment of the company's position?

Tested offline backups let Hamid Ltd restore its data without depending on the attacker, but it should still investigate how the intrusion happened, close the weakness and consider breach notification obligations. Paying is not the only route, doing nothing is inadequate, and deleting backups would be counterproductive.

  1. APaying the ransom is the only way to recover the data
  2. BBecause backups exist, the company can restore data and reduce reliance on the attacker, though it must still investigate how the breach occurred and consider notification dutiesCorrect
  3. CBecause backups exist, no further action is needed
  4. DThe company should delete the backups to prevent them being encrypted too

Explanation

Tested offline backups allow restoration without paying. However, the entry route must be found and closed or reinfection may follow, and personal data may have been accessed, which can trigger notification duties. Saying no action is needed ignores this, and deleting backups removes the recovery option.

Did you get it right without looking?

One question tells you little. A timed set on Financial systems and technology shows your real accuracy, how long you take and where you lose marks.

Practise Financial systems and technologyFree diagnostic mock

More Financial systems and technology questions