A ransomware exercise asks: can you restore the production database to a point before the encryption? What must be true?

What the interviewer is testing

Whether your backup design accounts for an adversary who has already compromised the environment, which ordinary backup design does not.

What must be true

Backups must be immutable and outside the compromised blast radius. An attacker with production access will attempt to delete or encrypt backups first — that is standard practice in ransomware operations. Backups in the same account, reachable by the same credentials, are not backups.

Required: a separate account or subscription with different credentials and a different access path; object lock or immutable retention that even the account's own administrators cannot shorten within the retention window; and alerting on any attempt to modify retention settings.

Point-in-time recovery over a sufficient window. Ransomware is frequently discovered days or weeks after the initial compromise, and the encryption may have been staged gradually. Backups covering only seven days may contain the problem throughout.

A known-good point. You must be able to determine when the compromise started, which requires audit logs that are themselves immutable and retained. Without that, you do not know which backup to restore.

A measured restore time at production data volume, with the objective validated against it.

Restore into a clean environment, since restoring into the compromised one re-exposes the data immediately. That requires the environment to be rebuildable from infrastructure code.

The test that proves it

A full restore, timed, into an isolated environment, with the data verified as usable rather than merely present — on a schedule, not once.

What a strong answer adds

The uncomfortable question worth asking in any review: when did you last restore this system completely, and how long did it take? A recovery objective with no measured restore behind it is a number in a document, and restore time grows quietly as the database grows.

Common weak answers

Pointing at backup job success. Assuming the cloud provider's backups are immune to a compromised account.