Backup, Recovery and Data Protection

Learning objectives#

Explain backups, recovery and data protection; compare full, incremental and differential backups; and describe why isolated recoverable copies and restoration tests matter.

Backup and recovery are not the same#

A backup is a separately retained copy of data intended to enable recovery after accidental deletion, corruption, hardware failure, ransomware or other incidents. Recovery is the process of restoring data or service into a usable state. Merely having a file displayed in two synchronized devices is not proof of a good backup: synchronization can propagate deletion or corruption to both copies.

A restore test checks whether retained information is actually recoverable. A backup that was never verified may be incomplete, unreadable or inaccessible when needed. Organizations also protect backups from unauthorized access because they can contain sensitive customer information.

Three common backup methods#

A 'backup chain' is an ordered set of backups required to reconstruct a point in time; which files are needed depends on the method and backup product.

The 3-2-1 idea and stronger resilience#

The often-taught 3-2-1 guideline suggests three copies of important data (including the working copy), on two kinds of storage/media, with one copy stored separately or off-site. It is a rule of thumb, not a universal regulation or guarantee. Modern strategies may add offline, immutable or isolated copies and regular restore verification to resist ransomware. Copies must be access-controlled and encrypted as appropriate.

Offline backup is temporarily disconnected from ordinary networks and therefore less exposed to attackers who compromise live systems. An immutable backup uses technical controls intended to prevent changes/deletion for a retention period. Neither is a guarantee if access or configuration is flawed.

Recovery goals#

Recovery Point Objective (RPO) means the maximum acceptable amount of data loss measured in time—for example, if a system can tolerate losing at most one hour of recent records, its backups/replication must support that objective. Recovery Time Objective (RTO) means the targeted time to restore a service after disruption. Both are planning targets, not promises that every incident will always meet them.

A disaster recovery plan describes steps, people, resources and priorities for bringing technology services back. Business continuity is broader: it also includes how essential services continue while normal systems are impaired.

Why a bank needs a recovery process#

Imagine a branch's reporting files are encrypted by ransomware. Restoring a clean copy could be necessary, but the team should first follow incident handling procedures, prevent reinfection, verify backup integrity and ensure restored access rights are appropriate. Secretly keeping another unaudited copy of customer files on a personal drive is not an acceptable backup plan; it creates privacy and compliance risks.

Example: Full backup on Sunday; incrementals Monday and Tuesday. Restoring Tuesday's state typically requires Sunday's full plus the Monday and Tuesday incrementals. If backups are differential instead, restoring Tuesday generally needs Sunday's full and Tuesday's differential alone.

Exam facts#

Common confusions and exam traps#

• Sync ≠ backup: Deletions/errors may synchronize.
• Full ≠ most frequent necessarily: Backup frequency depends on needs.
• Incremental ≠ differential: Their reference points differ.
• Backup ≠ immune to ransomware: Attacker-accessible backups can also be damaged.
• Disaster recovery ≠ business continuity: The former is a technical subset of broader operations.

Quick revision#

1. A usable backup must be recoverable, appropriately isolated and protected.
2. Full copies everything selected; incremental copies recent changes; differential copies since the latest full.
3. 3-2-1 is a useful starting concept rather than a universal compliance rule.
4. RPO is about data loss; RTO is about downtime.
5. Test restore procedures; a successful backup job alone proves little.

Practice questions — CA-09-06#

1. The main reason for creating a backup is to:
A. Increase display refresh rate
B. Support restoring lost or damaged information
C. Replace a firewall
D. Check web spelling

2. A backup containing all selected data is a:
A. Full backup
B. Incremental backup
C. Hash signature
D. Temporary cookie

3. Changes since the most recent backup are commonly captured by a(n):
A. Full backup only
B. Firewall
C. Incremental backup
D. Virus scan

4. Changes since the most recent full backup are captured by a:
A. Restore test
B. Worm
C. Screen lock
D. Differential backup

5. What does RPO primarily measure?
A. Maximum acceptable data-loss window
B. Monitor resolution
C. Encryption key length
D. Number of network routers

6. RTO mainly describes:
A. OTP validity
B. Targeted service-restoration time
C. PIN strength
D. Internet protocol version

7. Why can ordinary synchronization fail as a backup strategy?
A. It uses files
B. It always encrypts data
C. It can propagate deletions or corruption
D. It is a network protocol

8. Which is the best evidence a backup can be used for restoration?
A. A reassuring file name
B. A password screenshot
C. A high-speed Internet plan
D. A successful controlled restore test

9. An offline backup can resist certain ransomware threats because it:
A. Is less reachable from compromised live systems
B. Always restores instantly
C. Cannot contain errors
D. Never requires authentication

10. The 3-2-1 approach is best understood as:
A. A universal legal requirement
B. A useful backup-planning guideline
C. A malware family
D. A data format

11. Which contrast is correct?
A. RPO is downtime, RTO is data loss
B. Both are passwords
C. RPO concerns data loss, RTO concerns restoration time
D. Both mean encryption

12. A bank keeps unauthorized customer copies on a personal cloud drive. This is:
A. Recommended for resilience
B. The same as an approved backup
C. Always required
D. An inappropriate data-handling practice

Answers and explanations — CA-09-06#

1. B — Support restoring lost or damaged information. A backup is a retained copy intended to enable recovery after a loss or incident.

2. A — Full backup. Full backups copy the complete set of data selected for protection.

3. C — Incremental backup. Incrementals typically save changes since the previous relevant backup.

4. D — Differential backup. Differential copies accumulate changes since the last full backup.

5. A — Maximum acceptable data-loss window. Recovery Point Objective describes tolerable data loss expressed in time.

6. B — Targeted service-restoration time. Recovery Time Objective is how quickly the service aims to be restored.

7. C — It can propagate deletions or corruption. Sync often mirrors the latest state, including accidental deletions.

8. D — A successful controlled restore test. Actually restoring data validates that the backup is usable.

9. A — Is less reachable from compromised live systems. Isolation reduces access to the copy from a compromised network.

10. B — A useful backup-planning guideline. 3-2-1 is a general resilience guideline, not an invariant regulation.

11. C — RPO concerns data loss, RTO concerns restoration time. Recovery point and recovery time targets measure different objectives.

12. D — An inappropriate data-handling practice. Backups must follow approved privacy, access, retention and organizational policies.