CSCU Data Backup and Recovery 2 — Questions and Answers
Question 1: What is the 3-2-1 backup rule?
- Back up data 3 times a day on 2 devices using 1 software
- Keep 3 copies of data on 2 different media types with 1 copy offsite (Correct answer)
- Use 3 encryption methods across 2 servers with 1 password
- Store 3 files in 2 folders on 1 hard drive
Correct answer: Keep 3 copies of data on 2 different media types with 1 copy offsite
The 3-2-1 backup rule is a best practice that recommends maintaining three copies of data, stored on two different media types, with one copy kept offsite for disaster recovery.
The 3-2-1 backup rule is a widely adopted data protection strategy. It specifies keeping three total copies of your data (one primary and two backups), storing them on two different types of storage media (such as internal hard drive and external drive, or local storage and cloud), and keeping one copy offsite or in the cloud. This approach protects against a wide range of failure scenarios including hardware failure, ransomware, natural disasters, and theft. Even if one backup location is compromised, the other copies ensure data can be recovered.
Question 2: What is the key difference between incremental and differential backups?
- Incremental backups are faster to restore than differential backups
- Incremental backups only save changes since the last backup of any type, while differential backups save all changes since the last full backup (Correct answer)
- Differential backups use less storage space than incremental backups
- There is no difference; the terms are interchangeable
Correct answer: Incremental backups only save changes since the last backup of any type, while differential backups save all changes since the last full backup
Incremental backups capture only changes since the last backup (full or incremental), using less storage but requiring more steps to restore. Differential backups capture all changes since the last full backup, using more storage but enabling faster restoration.
Incremental backups record only the data that has changed since the most recent backup of any type (full or incremental). This makes each incremental backup small and fast, but restoration requires the last full backup plus every subsequent incremental backup in sequence. Differential backups record all data that has changed since the last full backup. Each differential backup grows larger over time but restoration only requires the last full backup plus the most recent differential. Organizations choose between them based on backup window constraints, storage capacity, and required recovery time objectives (RTO).
Question 3: What is a Recovery Point Objective (RPO)?
- The maximum time allowed to restore a system after failure
- The maximum acceptable amount of data loss measured in time (Correct answer)
- The total cost of recovering lost data
- The number of recovery attempts allowed before escalation
Correct answer: The maximum acceptable amount of data loss measured in time
RPO defines the maximum period of data loss an organization can tolerate, determining how frequently backups should be performed.
Recovery Point Objective (RPO) is a critical metric in disaster recovery planning that defines the maximum acceptable amount of data loss measured in time. For example, an RPO of 4 hours means the organization can tolerate losing up to 4 hours of data, so backups must occur at least every 4 hours. An RPO of zero means no data loss is acceptable, requiring real-time replication. RPO is distinct from Recovery Time Objective (RTO), which measures how quickly systems must be restored. Together, RPO and RTO drive backup frequency, technology choices, and infrastructure investment.
Question 4: Why should backup integrity be regularly tested?
- To ensure the backup software license is still valid
- To verify that backup data can be successfully restored when needed (Correct answer)
- To reduce the size of backup files
- To increase the speed of the backup process
Correct answer: To verify that backup data can be successfully restored when needed
Regular backup testing verifies that backup data is complete, uncorrupted, and can be successfully restored, ensuring the organization can actually recover from data loss events.
Backup integrity testing is the process of periodically verifying that backup data can be successfully restored and that the recovered data is complete and accurate. Without regular testing, organizations may discover too late that their backups are corrupted, incomplete, or incompatible with current systems. Testing should include full restoration drills, checksum verification, and validation that restored applications function correctly. Industry best practices recommend testing backups at least quarterly, with critical systems tested monthly. Many compliance frameworks require documented backup testing as part of their audit requirements.
Question 5: What type of malware specifically targets backup files to prevent data recovery?
- Spyware
- Adware
- Ransomware (Correct answer)
- Browser hijackers
Correct answer: Ransomware
Modern ransomware variants specifically seek out and encrypt or delete backup files to prevent victims from recovering their data without paying the ransom.
Ransomware has evolved to specifically target backup files and backup infrastructure. Advanced ransomware variants search for backup file extensions, shadow copies, backup software databases, and network-attached backup devices, encrypting or deleting them before encrypting primary data. This eliminates the victim's ability to restore data independently, increasing the pressure to pay the ransom. Countermeasures include maintaining air-gapped backups (physically disconnected from the network), using immutable backup storage that prevents deletion or modification, implementing backup encryption with separately stored keys, and using backup solutions with built-in ransomware detection.
Question 6: What is an air-gapped backup?
- A backup stored in a compressed format
- A backup stored on media that is physically disconnected from any network (Correct answer)
- A backup that is encrypted with a strong password
- A backup stored on a cloud service with limited access
Correct answer: A backup stored on media that is physically disconnected from any network
An air-gapped backup is stored on media physically disconnected from all networks, making it immune to network-based attacks like ransomware.
An air-gapped backup is stored on media that is physically isolated from all network connections—there is literally an air gap between the backup and any connected system. Common air-gapped media includes external hard drives stored in a safe, tape backups kept offsite, or optical media. Because the backup has no network connectivity, it cannot be reached by ransomware, hackers, or any network-based attack. The tradeoff is that air-gapped backups require manual processes to create and rotate, and they cannot provide continuous data protection. Despite this inconvenience, air-gapped backups are considered the last line of defense against sophisticated cyberattacks.
CSCU Data Backup and Recovery 2
What is the 3-2-1 backup rule?