During the Recovery phase of an incident, the team restores a compromised server from a backup taken 48 hours before the incident was detected. The attacker had been present for 5 days before detection. What critical problem exists with this recovery approach?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — restoring a backup taken 48 hours before detection is risky because the attacker had already been inside for 5 days, so the backup was made after the initial compromise. You may restore the attacker's persistence mechanisms along with legitimate data.
Full Explanation
The correct answer is the backup was taken after the initial compromise; the attacker may have already established persistence that is restored along with legitimate data. The attacker was present for 5 days before detection, and a backup taken 48 hours before detection still falls within the attacker's dwell period, about 3 days after initial compromise; restoring this backup may restore the attacker's persistence mechanisms alongside legitimate data. The option about the backup being too large to restore within the incident SLA is wrong because backup restore time is an operational concern, not a security problem. The option about backups older than 24 hours not being admissible as forensic evidence is wrong because backup admissibility as forensic evidence is not the issue here; the problem is restoring attacker artifacts. The option about the backup not being usable because it was not taken during the incident window is wrong because backups taken before an incident can be used for recovery if they predate the compromise; the problem here is that the backup does not predate the compromise.