- A crash-consistent snapshot of an active database is restored. What is true?
Answer: Log replay may be needed
A crash-consistent snapshot captures storage at a point in time but not the database's transaction state. In-flight or recently committed transactions may not be fully written, so database recovery must replay logs to restore consistency. The tempting wrong answer is "No log replay is needed" because crash consistency sounds final, but it only guarantees file-level consistency, not application consistency.
- Which of the following storage technologies provides the lowest recovery time by maintaining a continuously updated replica of production data at a secondary site?
Answer: Synchronous replication that mirrors every write operation to a secondary storage system in real time.
Synchronous replication maintains a real-time mirror, enabling near-zero RPO (virtually no data loss) and the fastest possible RTO (failover within seconds). Answer D is correct. Tape (A), disk (B), and snapshots (C) all introduce data loss windows and require active restore processes, resulting in longer RTO and RPO.
- A company performs full backups every Sunday and incremental backups Monday through Saturday. A system failure occurs on Friday. To restore the system completely, the company must restore:
Answer: The Sunday full backup plus all incremental backups from Monday through Thursday.
Incremental backups only capture changes since the last backup. To restore fully, the last full backup (Sunday) must be restored first, then each incremental backup applied in sequence (Mon, Tue, Wed, Thu) to rebuild the complete data state. Answer C is correct. The most recent incremental alone (A) only contains Thursday's changes. The full backup alone (B) is missing a week of changes. Incrementals without the full backup (D) cannot reconstruct the complete dataset.
- Which control most directly detects that backups cannot be restored?
Answer: Periodic restore testing
Restore testing actually attempts to read data back from backups, so it directly verifies that backups can be recovered when needed. Automated backup alerts are the most tempting choice, but they only confirm that backup jobs ran, not that the data can be restored. Offsite copies and encryption address availability and confidentiality, not recoverability.
- Which of the following is the primary advantage of cloud-based backup solutions over traditional tape-based offsite backup?
Answer: Cloud backups can be performed continuously or on short intervals, accessed remotely, and restored without physical media retrieval, reducing both RPO and RTO.
Cloud backup enables near-continuous backup, remote accessibility, and instant retrieval - significantly reducing RPO (by backing up more frequently) and RTO (by eliminating physical media transport). Answer B is correct. Cloud costs scale with volume and are not always cheaper (A). Backup testing remains essential regardless of medium (C). Cloud-stored data is still subject to privacy regulations (D).
- A company stores backup copies of its financial data for seven years to comply with regulatory retention requirements. The primary reason for this long retention period is:
Answer: Regulatory requirements (such as SOX, tax laws, or audit standards) mandate that financial records be available for examination for a specified period.
Long retention periods for financial data are driven by regulatory requirements - various laws require organizations to retain financial records so they are available for audits and regulatory examinations. Answer C is correct. Media degradation (A) is a storage concern, not a driver of retention periods. GAAP does not specify a universal seven-year retention (B). Recovery from system failures (D) typically requires much shorter retention periods.
- The recovery time objective (RTO) is best defined as:
Answer: The maximum acceptable duration of downtime before a system must be restored to operational status.
RTO defines how long a system can be offline before the impact becomes unacceptable - the maximum tolerable downtime. Answer D is correct. The maximum data loss in time is the recovery point objective (RPO) - Answer A. The point-in-time restoration target is RPO (B). Recovery cost is not defined by RTO (C).
- RAID 1 mirrors all writes. Which data loss requires backups?
Answer: Data corruption on both disks
RAID 1 protects you when a single disk fails or during a rebuild, because the surviving copy is used. But if corruption affects both mirrored disks, there is no valid copy left, so RAID cannot recover the data. The tempting wrong answer is one disk failing, but that is exactly what mirroring handles automatically. Backups protect against data corruption and other threats that RAID cannot.
- An organization's backup media management policy requires that backup tapes be degaussed before disposal. The primary purpose of degaussing is to:
Answer: Permanently destroy data on magnetic media by exposing it to a strong magnetic field, preventing recovery of sensitive information.
Degaussing uses a powerful magnetic field to erase data from magnetic media (tapes, hard drives) rendering it unrecoverable - a critical data destruction control for protecting sensitive information when disposing of media. Answer A is correct. Testing media (B), encrypting before recycling (C), and transferring data (D) are different processes unrelated to degaussing.
- An auditor is reviewing a company's backup and recovery controls and wants to assess whether backups are actually restorable. Which of the following audit procedures provides the most direct evidence?
Answer: Observing or reviewing results of a backup restoration test where data is actually recovered from backup media.
The only way to definitively confirm backups are restorable is to test the restoration process - verifying that data can actually be recovered, not just that the backup job completed. Answer D is correct. Policy review (A), interviews (B), and log inspection (C) provide indirect evidence of backup processes but do not confirm recoverability.
- The '3-2-1 backup rule' recommends that organizations:
Answer: Maintain three copies of data, on two different storage media types, with one copy stored offsite.
The 3-2-1 rule is a backup best practice: 3 total copies of data, stored on 2 different media types (e.g., disk and tape), with 1 copy kept offsite to protect against localized disasters. Answer D is correct. The other answers fabricate rules not associated with the 3-2-1 principle.
- Which of the following best describes a 'hot site' in the context of disaster recovery?
Answer: A fully equipped and operational backup facility with live system replicas that can take over operations within minutes.
A hot site is a fully operational duplicate facility with live data replication, enabling near-instantaneous failover - the highest level of disaster recovery readiness. Answer C is correct. Data-only storage (A) describes a cold site's partial capability. Partially equipped hardware (B) describes a warm site. Mobile units (D) are a different recovery approach.
- A company experiences a ransomware attack that encrypts all production data. The attack also encrypted all backup files stored on the same network share as the production systems. Which backup practice would have prevented the backup data from being compromised?
Answer: Storing backups on isolated, offline, or immutable storage that is not accessible from the production network.
Ransomware encrypts everything accessible from an infected system. Backups stored on the same network are equally vulnerable. Offline (air-gapped) or immutable backups cannot be accessed or altered by ransomware, preserving recovery capability. Answer B is correct. Speed (A) is impractical against automated ransomware. Encrypting backups (C) doesn't prevent ransomware from re-encrypting them. Compression (D) does not protect against ransomware.
- An organization implements a 'geo-redundant' storage strategy. This means:
Answer: Data is replicated across multiple geographically separated data centers to protect against regional disasters.
Geo-redundancy involves replicating data across physically separated locations - different buildings, cities, or regions - so that a localized disaster (flood, power outage, fire) affecting one location does not result in data loss. Answer D is correct. Multi-format storage (A), concurrent access (B), and geographic data organization (C) do not describe geo-redundancy.
- An organization uses deduplication technology in its backup system. The primary benefit of deduplication is:
Answer: Reducing backup storage requirements by identifying and eliminating redundant data blocks, storing only unique data.
Deduplication analyzes backup data and stores only unique data blocks, replacing duplicates with pointers - significantly reducing storage consumption and backup transmission size. Answer B is correct. Deduplication does not inherently speed restoration (A), encrypt data (C), or verify restorability (D).
- Which of the following statements about business continuity planning (BCP) and disaster recovery planning (DRP) is correct?
Answer: BCP is the broader plan addressing overall organizational resilience during disruptions; DRP is a component of BCP focused specifically on restoring IT systems and infrastructure.
BCP encompasses all aspects of organizational continuity - people, processes, facilities, communications, and technology. DRP is a technical subset focused specifically on IT system and data recovery. Answer D is correct. They are not interchangeable (A). BCP is the broader concept (B). BCP addresses business processes, not just IT (C).
- RPO 30m, RTO 4h. Backup at 06:00; failure at 07:45; restore takes 3h. Which is true?
Answer: RPO violated; RTO met
Failure at 07:45 leaves 1h45 of data since the 06:00 backup, exceeding the 30m RPO, so RPO is violated. Restore ends at 10:45, only 3h after failure, within the 4h RTO, so RTO is met. The tempting error is counting the 1h45 before failure toward RTO, making recovery look like 4h45 and both violated.
- Which of the following is the most important control to verify that backup processes are operating correctly on an ongoing basis?
Answer: Monitoring backup job completion alerts and logs daily, with escalation procedures for failed or incomplete backups.
Daily monitoring of backup completion logs and immediate escalation of failures ensures that backup issues are detected and resolved quickly, before they create a recovery gap. Answer C is correct. Annual policy sign-off (A) and plan documentation (D) are governance activities. Offsite storage (B) addresses location, not completeness monitoring.
- An organization's backup policy requires that all backup media be encrypted before leaving the data center. The primary purpose of this requirement is to:
Answer: Prevent unauthorized individuals from reading sensitive data if backup media is lost or stolen during transit or storage.
Encrypting backup media protects data confidentiality if media is lost, stolen, or mishandled during transport or offsite storage. Answer A is correct. Encryption does not improve compression (B), verify backup completeness (C), or apply specifically to network transmission (D) - though network transmission encryption is a separate requirement.
- Which of the following best describes a 'snapshot' in the context of storage and backup?
Answer: A point-in-time logical image of a storage volume that captures the state of data without necessarily copying all blocks immediately, enabling fast creation and recovery.
A snapshot captures a logical point-in-time view of data, often using copy-on-write techniques to create it instantly without copying all data immediately. Snapshots enable fast rollback to prior states. Answer B is correct. A full physical copy (A) describes a clone or mirror. Tape archives (C) describe traditional backup. Encrypted offsite copies (D) describe encrypted backups.
