4 of the 12 questions we have for this objective, shown with the answer and the reasoning.
Design a resiliency strategy for ransomware and other attacks based on Microsoft Security Best Practices
Pinecrest Grocers runs its order-fulfillment application on 18 VMware virtual machines in a single on-premises datacenter. The business has set a recovery time objective of one hour and a recovery point objective of 15 minutes for this application, and the company does not want to build a second physical datacenter because of cost. The application tiers must come back online in a specific order and the plan must be rehearsed without disrupting production.
What should you recommend?
- ABack up the VMs to Azure with Microsoft Azure Backup Server and restore them to Azure VMs when the datacenter failsBackup provides a nightly or hourly recovery point and a restore that takes hours for 18 VMs, so it cannot meet a 15-minute RPO or a one-hour RTO with ordered startup.
- BReplicate the VMs to Azure with Azure Site Recovery and define a recovery plan that groups tiers and supports test failoverSite Recovery replicates VMware VMs to Azure continuously, recovery plans sequence the tiers into startup groups with optional scripts, and test failover rehearses the plan in an isolated network without touching production.
- CCopy the VM disks to a geo-redundant Azure Storage account on a nightly scheduleA nightly disk copy gives a 24-hour RPO and no orchestration or automated failover, so it misses both the RPO and the ordered-recovery requirement.
- DUse Azure Migrate to move the application to Azure virtual machines in two availability zonesMigration changes where production runs rather than providing disaster recovery for the on-premises datacenter, and the scenario asks for a DR design, not a migration.
Why: The RTO and RPO figures decide between backup and replication: a one-hour RTO and 15-minute RPO for a multi-tier application require continuous replication with orchestrated failover, which is what Azure Site Recovery provides, while backup-and-restore is measured in hours and daily points. The cost constraint of avoiding a second datacenter makes Azure the recovery site. Recovery plans satisfy the ordered startup and test failover satisfies the rehearsal requirement. The trap is treating backup as a substitute for disaster recovery; both belong in a BCDR strategy but they serve different recovery objectives.
Design a resiliency strategy for ransomware and other attacks based on Microsoft Security Best Practices
Marlow Health operates patient-scheduling and billing workloads in Azure and AWS and uses Microsoft Defender XDR across its endpoints and identities. The security team receives several hundred posture recommendations each week and cannot act on all of them. The CISO wants remediation effort to be prioritized toward threats that could realistically reach the billing database and the Active Directory Domain Services domain controllers, and wants that prioritization to update automatically as the environment changes.
What should you recommend?
- ATag the billing database and domain controllers as critical assets in Microsoft Security Exposure Management and prioritize remediation by attack paths that lead to themExposure Management lets you classify business-critical assets and then surfaces the attack paths and choke points that lead to those assets, so remediation is ranked by real exposure of the systems that matter and recalculates continuously.
- BSort all Microsoft Defender for Cloud recommendations by severity and remediate High findings across every subscription firstSeverity sorting treats a high finding on a test VM the same as one on a domain controller and does not consider whether an attacker could chain findings to reach the critical assets.
- CRaise Microsoft Secure Score by completing the highest-point improvement actions each weekSecure Score measures overall posture improvement, not exposure of specific business-critical assets, so chasing points does not guarantee the billing path is closed first.
- DSchedule a quarterly manual threat-modeling workshop for the billing applicationThreat modeling is valuable, but a quarterly manual exercise cannot keep up with a changing hybrid environment or satisfy the requirement that prioritization update automatically.
Why: Identifying and prioritizing threats to business-critical assets is the core of a resiliency strategy, and Microsoft Security Exposure Management is the product designed for it: you classify critical assets, and the service maps attack paths from the external surface to those assets so you fix the choke points first. The deciding constraints are the overwhelming volume of findings and the requirement that prioritization follow the critical assets automatically. Severity-sorted recommendations and Secure Score are the traps because they measure posture in aggregate rather than exposure of the specific crown jewels the CISO named.
Design a resiliency strategy for ransomware and other attacks based on Microsoft Security Best Practices
Stonebridge Credit Union has suffered a human-operated ransomware attack that encrypted file servers, the loan-origination application, and all four Active Directory Domain Services domain controllers. The attacker held Domain Admin credentials. Immutable backups exist in an isolated Azure subscription, and Microsoft Entra ID remains uncompromised. Executives want the loan application restored immediately because it generates revenue, but the architect must recommend a recovery sequence that does not allow the attacker to re-encrypt the restored systems.
Which recovery sequence should you recommend?
- ARestore the loan-origination application first to resume revenue, then restore the domain controllers, then the file servers, then reset privileged credentialsRestoring a business application into a domain whose identity tier is still controlled by the attacker means the attacker's credentials remain valid and the application can be re-encrypted immediately.
- BContain the environment, restore and harden the identity tier (domain controllers) from clean recovery points and reset all Tier 0 credentials, then restore business-critical applications in priority order, then remaining systemsIdentity is the control plane for everything else; rebuilding domain controllers from clean points and rotating every Tier 0 credential, including the krbtgt account, removes the attacker's persistence before dependent applications come back.
- CRestore all systems in parallel from the most recent recovery points to minimize total downtime, then investigate the intrusionThe most recent recovery points may already contain the attacker's tooling, and restoring everything at once with no containment or credential reset re-creates the compromised state.
- DRebuild the domain controllers by promoting new servers that replicate from the surviving domain controller, then restore applicationsThere is no clean surviving domain controller in this scenario; replicating from an encrypted or attacker-controlled DC propagates the compromise into the new forest.
Why: In a ransomware recovery the identity tier comes first because every other system trusts it; if the attacker still holds Domain Admin, anything restored into that domain is restored into the attacker's hands. The recommended sequence is contain, recover and harden Tier 0 identity from recovery points known to predate the compromise, reset privileged secrets, and then bring back business-critical applications in business-priority order. The deciding constraint is preventing re-encryption, which overrides the executives' request to restore revenue systems first. The trap is the revenue-first sequence, which feels urgent but hands the restored application straight back to the intruder.
Design a resiliency strategy for ransomware and other attacks based on Microsoft Security Best Practices
Bellhaven Hospitals already has immutable, tested backups for its clinical systems. A recent penetration test showed that help-desk staff sign in to their daily workstations with accounts that are members of Domain Admins, and that the same accounts are Global Administrators in Microsoft Entra ID. The next ransomware workstream must limit the blast radius of a single compromised help-desk workstation so that one phishing email cannot lead to domain-wide encryption.
What should you recommend?
- AImplement the enterprise access model with separate privileged accounts, privileged access workstations for Tier 0 roles, and just-in-time activation through Microsoft Entra Privileged Identity ManagementSeparating privileged accounts from daily-use accounts, confining Tier 0 administration to hardened workstations, and granting roles only on demand means a compromised help-desk workstation yields no standing domain or tenant control.
- BRequire multifactor authentication for all users through a Conditional Access policyMFA for everyone is a baseline control, but it does not remove standing Domain Admin membership from daily workstations, and a token stolen from a signed-in session still carries full privilege.
- CEnforce a 30-day password rotation policy for all administrator accountsPassword rotation does nothing against a workstation compromise that captures the session or credential in real time, and it leaves the privilege boundary unchanged.
- DDeploy Microsoft Defender for Endpoint to the help-desk workstationsEndpoint detection and response improves the chance of catching the intrusion, but it is a detection control; the design flaw is that the compromised workstation holds domain-wide privilege.
Why: The second phase of ransomware mitigation is limiting the scope of damage, and in human-operated ransomware the damage comes from privileged credentials harvested from ordinary workstations. The enterprise access model fixes the structural problem: privileged roles use dedicated accounts, Tier 0 work happens only from privileged access workstations, and roles are activated just in time rather than held permanently. The deciding constraint is blast radius from one compromised help-desk device, which MFA, rotation, and EDR each leave intact because the account on that device still owns the domain. The trap is MFA, which is necessary but does not separate daily-use identities from privileged ones.