Security Architecture · Topic 2 of 12
Backup, Recovery and Continuity
Match backup types, replication, immutable copies, recovery sites and recovery testing to RTO and RPO targets and to ransomware resilience goals.
- 5 min
- RTO is time to restore, RPO is tolerable data loss, and both set the design.
- Incremental backups are fast to take but slow to restore, differential backups restore faster.
- Snapshots are not a substitute for off system backups.
What it is
Recovery design brings a system back to a working state after loss of data or facilities. It is driven by two targets from the business impact analysis: the recovery time objective (RTO), which is how fast service returns, and the recovery point objective (RPO), which is how much data can be lost.
Backups are the last line of defense against ransomware, human error and corruption. Because attackers target backups too, the design must keep at least one copy out of their reach.
How it works
Backup types
| Type | What is copied | Backup speed | Restore |
|---|---|---|---|
| Full | Everything | Slowest, largest | Simplest, one set |
| Incremental | Changes since the last backup of any type | Fastest, smallest | Slowest, needs the full plus every increment |
| Differential | Changes since the last full backup | Medium | Needs the full plus the latest differential |
Snapshots capture a point in time state of a volume or virtual machine quickly, but they usually live on the same storage and so are not a full backup on their own. Journaling and continuous data protection record every change, which allows very small RPO values.
Replication
Replication copies data to another system or site as it changes. Synchronous replication confirms the write at both sites, giving near zero data loss but adding latency and requiring short distances. Asynchronous replication confirms locally and sends later, which tolerates distance but allows some data loss.
Replication is not backup, because it copies mistakes and encryption by malware to the replica. Keep versioned backups as well.
Protecting the backups
A widely used guide is the 3-2-1 rule: three copies, on two kinds of media, with one off site. A common extension adds one copy that is offline, air gapped or immutable.
- Immutable storage: data cannot be changed or deleted for a set period, even by an administrator.
- Offline or air gapped copy: unreachable from the production network.
- Encryption: protects backup data in transit and at rest, with keys stored separately from the data.
- Separate credentials: the backup system should not share administrator accounts with production.
Recovery sites
| Site | State | Recovery time | Cost |
|---|---|---|---|
| Hot | Running and synchronized | Minutes to hours | Highest |
| Warm | Equipment ready, data restored when needed | Hours to days | Medium |
| Cold | Space and power only | Days or longer | Lowest |
Cloud services can provide on demand recovery capacity, which gives warm site speed without paying for idle hardware. Choose the site type from the RTO, not from habit. If the RTO is minutes, only a hot or automated cloud failover design fits.
Restoration order
Systems depend on one another, so recovery follows a sequence. Foundation services such as network, directory services and the Domain Name System (DNS) come first, then data stores, then applications, then user access. The order should be written in the plan and based on the dependency map and the business impact analysis.
Testing
Plans that are never tested fail. Testing methods grow in realism and cost.
| Method | What it does |
|---|---|
| Tabletop exercise | Participants talk through a scenario without touching systems |
| Walkthrough | Team checks the plan step by step against the documented procedures |
| Simulation | A realistic scenario run with some systems involved |
| Failover test | Production moves to the standby site |
| Parallel processing | The recovery system runs alongside production to compare results |
Test restores, not only backups. A backup that has never been restored may be corrupt or incomplete. Record the results, including actual times against the RTO and RPO, and fix the gaps.
What to remember for the exam
- RTO is time to restore, RPO is tolerable data loss, and both set the design.
- Incremental backups are fast to take but slow to restore, differential backups restore faster.
- Snapshots are not a substitute for off system backups.
- Synchronous replication gives the smallest data loss but needs low latency, asynchronous allows distance.
- Replication copies corruption and ransomware, so keep immutable or offline backups.
- The 3-2-1 rule means three copies, two media types, one off site.
- Hot, warm and cold sites trade cost against recovery time.
- Restoration order follows dependencies, with network, identity and DNS first.
When a scenario mentions ransomware that encrypted both production and its replica, the fix is an immutable or offline backup copy.
Common mistakes
Calling replication a backup. It protects against site loss but copies deletions and malware.
Picking a cold site for a short RTO. A cold site cannot meet minutes or a few hours because hardware and data must be provided first.
Leaving backup admin on the domain. If attackers control the domain, they can delete backups, so use separate accounts and immutability.
Testing only tabletops. Talking through a plan does not prove that data restores or that failover works.
Encrypted backups are useless if the only copy of the key is lost or sits on the system being restored.
Check yourself
Work through these three questions.
Why is replication alone not enough against ransomware?
It copies the encrypted or deleted data to the replica, so versioned immutable or offline backups are also needed.
Which backup type needs the last full backup plus only one other set to restore?
Differential, because it holds all changes since the last full backup.
Which recovery site gives the shortest recovery time?
A hot site, which is already running with current data.
Topic 2 of 12 in Security Architecture
Test yourself on Security Architecture
The full CompTIA SecurityX CAS-005 question bank has 654 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.