Attackers used stolen administrator credentials to encrypt the company's backup repository along with its production servers. Which backup capability would have prevented them from altering or deleting the existing backup copies, even with administrator rights?
Select an answer to reveal the explanation.
Short Explanation
Think of immutable backups as writing in permanent ink: once it's down, nobody, not even an admin, can erase or change it until the retention date passes. Encryption doesn't help here, since ransomware happily encrypts files that are already encrypted. You need copies that simply can't be touched.
Full Explanation
Immutable backups are written to storage that enforces write-once, read-many behavior for a defined retention period, so no user or process, including one holding administrator credentials, can modify or delete them until that period expires. Ransomware operators routinely target backups first to remove recovery options, and immutability is the control designed to survive exactly that attack. Incremental backups change how much data is copied each run, which affects speed and storage, but the resulting sets sit on the same writable repository and can be encrypted just as easily. Encrypting backups protects their confidentiality, yet the attacker does not need to read them; overwriting or re-encrypting the files destroys their usefulness, and a key stored on the compromised server may be stolen as well. Longer retention keeps more versions, but every one of those versions remains deletable by an administrator, so the attacker removes them all in a single pass. Exam caveat: immutability is often paired with separate credentials or an offline or logically air-gapped copy, because a compromised control plane could otherwise shorten retention settings. Operational check: attempt to delete or overwrite a backup within its lock period using an administrator account and confirm the operation is refused, then confirm the lock settings cannot be lowered by the same account.