A ransomware infection on a database server encrypted the data files and also every backup file stored on a network share that the server's service account could write to. The team is redesigning its protections. Which preparation would most limit the damage from a repeat attack?

Ransomware encrypts every file reachable with the privileges it gains, and attackers deliberately seek out backups to remove the option of recovery. The key preparation is backup copies the compromised host cannot alter: immutable storage that refuses modification or deletion for a retention period, or offline or air-gapped copies with credentials separate from the database server. Endpoint protection on database hosts adds prevention and detection so infections are stopped or caught earlier. Together they reduce both the chance of infection and the impact if it happens. A second share mapped on the same server with administrator credentials is still reachable from that server, and ransomware that captures those credentials or runs with elevated privileges encrypts it as well. RAID 10 protects against disk failure; it faithfully mirrors encrypted blocks, so it provides no recovery from malicious encryption. Transparent encryption at rest protects stored files against offline theft, but it does not stop malware with file-system access from encrypting those files again, which makes them unusable. Exam caveat: redundancy and replication are not backups, and a backup the attacker can reach is not a recovery option. Operational check: confirm a recent backup exists in immutable or offline storage and complete a test restore from it.