220-1102 Question 704
Single answer3-2-1 backup ruleA small accounting firm was hit by ransomware that encrypted files on its main file server and on a USB backup drive that was left plugged into the server. The office manager says the company has been "backing up regularly," but the technician discovers the only copies of the data were the live server data and a nightly backup written to that attached USB drive. Which backup plan would BEST align with the 3-2-1 backup rule and reduce the chance of the same problem happening again?
- A
Keep the current server data, continue nightly backups to the attached USB drive, and add a second backup job to another partition on the same server
- B
Keep the current server data, back up to a local NAS in the office, and replicate backups to a cloud backup service with versioning
- C
Keep the current server data, copy files manually to two different folders on the server each week, and archive older copies to the recycle bin
- D
Keep the current server data, back up to two external drives that are both left connected to the server at all times
Show answer and explanation
Correct answer: B
Explanation
The 3-2-1 backup rule is a widely accepted best practice: maintain at least 3 copies of data, store them on at least 2 different types of media or storage systems, and keep at least 1 copy offsite. In a real-world ransomware scenario, backups that remain continuously connected to the infected system can also be encrypted, which defeats the purpose of having a backup. The best answer includes a local backup for quick restores and an offsite backup for disaster recovery, while also using versioning to recover from data corruption or ransomware. This approach aligns with common backup best practices recommended by vendors and security guidance, including maintaining isolated or offsite recovery points rather than relying only on directly attached or same-system storage.
- A. Incorrect.
Incorrect. This does not meet the 3-2-1 rule because the extra partition is not a separate backup medium; it is still on the same system and is vulnerable to the same hardware failure, corruption, or ransomware event. The attached USB drive is also online and accessible to malware, which is exactly what caused the previous backup to be encrypted.
- B. Correct.
Correct. This plan best matches the 3-2-1 rule: 3 copies of the data (production data plus two backups), on 2 different media/storage types (for example, server storage and a NAS/cloud target), with 1 copy offsite (the cloud backup service). Versioning also improves recovery from accidental deletion or ransomware by allowing restoration of earlier unencrypted versions.
- C. Incorrect.
Incorrect. Multiple folders on the same server are not separate backups in any meaningful disaster-recovery sense. They rely on the same device and do not satisfy the requirement for different media or an offsite copy. The recycle bin is not a backup archive and is not appropriate for long-term recovery.
- D. Incorrect.
Incorrect. Although there are multiple backup devices, leaving both connected all the time makes them vulnerable to ransomware and does not satisfy the offsite component of 3-2-1. Two always-connected drives in the same location are still exposed to the same local threats, including theft, fire, and malware.