SY0-701 Question 246
Single answerBackups: Onsite/offsite , Frequency , Encryption , Snapshots , Recovery , Replication , JournalingA company runs a customer order database on a virtualized server. After a recent ransomware incident, leadership sets two recovery requirements: the business must be able to restore service in less than 1 hour, and no more than 15 minutes of data can be lost. The security administrator also wants backup data protected if stolen from a storage provider or backup media. Which solution BEST meets these requirements?
- A
Perform weekly full backups to an onsite NAS without encryption and rely on manual restoration if the VM fails
- B
Create hourly snapshots on the production storage array only, with no offsite copies or backup encryption
- C
Use encrypted backups replicated to an offsite location every 15 minutes, with recovery procedures regularly tested
- D
Enable journaling on the database volume and keep monthly tape backups in an unlocked storage room
Show answer and explanation
Correct answer: C
Explanation
The scenario is testing the candidate's ability to match backup and recovery controls to business requirements. The requirement to lose no more than 15 minutes of data maps to the recovery point objective (RPO), so backups or replication need to occur at least every 15 minutes. The requirement to restore service in less than 1 hour maps to the recovery time objective (RTO), so the organization needs a recovery method that is fast and tested. Offsite storage is important because onsite-only copies can be destroyed, encrypted, or otherwise impacted in the same incident affecting production systems. Encryption of backups is a standard best practice for protecting data at rest, particularly when stored with third parties or transported on removable media. Snapshots can be useful for quick restores, but they are not sufficient by themselves when they reside only on the same production system. Journaling improves consistency and can help recovery operations, especially for databases and file systems, but it does not replace backups. These principles align with common guidance from NIST contingency planning and data protection best practices, including the need for protected backup media, alternate storage locations, and regular recovery testing.
- A. Incorrect.
This is incorrect because weekly full backups do not meet the requirement to lose no more than 15 minutes of data. An onsite-only NAS also creates a single point of failure if the site is impacted by ransomware, fire, or theft. In addition, leaving backups unencrypted does not protect backup data at rest if the NAS or media is stolen.
- B. Incorrect.
This is incorrect because snapshots can support fast recovery, but snapshots on the same production storage are not sufficient backup protection by themselves. They may be deleted or encrypted during a ransomware event, and without offsite copies they do not provide resilience against site failure. The lack of encryption also fails the requirement to protect backup data if storage is stolen.
- C. Correct.
This is correct because replication or backup transmission every 15 minutes aligns with the stated maximum data-loss tolerance, effectively supporting a 15-minute recovery point objective (RPO). Keeping copies offsite improves resilience against ransomware and site disasters, and encrypting backups protects confidentiality if storage media or a provider is compromised. Regularly testing recovery procedures is also a best practice because successful backup jobs do not guarantee successful restores, and the less-than-1-hour restoration target reflects a recovery time objective (RTO) that must be validated.
- D. Incorrect.
This is incorrect because journaling helps record file system or transaction changes for consistency and recovery, but it is not a substitute for a complete backup strategy. Monthly tape backups are too infrequent to meet the 15-minute data-loss requirement, and storing them in an unlocked room creates a physical security weakness. This option also does not address rapid recovery within 1 hour.