Parks ransomware recovery restores POS and reservation VMs that must stay isolated until they are verified clean. Which combined-stack action matches the security BC/DR runbook?

When Parks ransomware recovery restores POS and reservation VMs that must stay isolated until verified clean, the combined-stack action that matches the security BC/DR runbook is to keep Carbon Black Cloud prevention enabled on restored endpoints and leave Distributed Firewall default-deny until restore groups are explicitly allowed. Treat restored carts as quarantined until both the endpoint guard and the hallway locks say they are clean. Placing restored VMs on the Distributed Firewall exclusion list and setting Carbon Black Cloud sensors to global bypass fails by concept because that combination removes both network and endpoint enforcement during the riskiest window. Disabling NSX-T Distributed Firewall at the parks cluster so restore traffic is unconstrained fails because unconstrained east-west is the opposite of isolation-until-verified. Relying on vSphere DRS affinity rules instead of Carbon Black Cloud or Distributed Firewall during recovery fails because DRS affinity is placement, not security isolation. Exam caveat: ransomware restore isolation uses CBC prevention plus DFW default-deny until explicit restore-group allows. Operational check: restore POS and reservation VMs into quarantine groups, confirm CBC prevention and DFW deny, allow only after clean verification, and document the dual-stack quarantine in the parks ransomware runbook.