This chapter covers the 3-2-1 backup strategy, a foundational principle of data protection that you must know for the CompTIA A+ 220-1102 exam. It is part of Domain 4.0 (Operational Procedures), specifically Objective 4.3: 'Given a scenario, implement backup and recovery methods.' While not a huge percentage of the exam, questions on backup strategies appear regularly, and the 3-2-1 rule is a favorite for scenario-based questions. This chapter will explain the rule, its components, how to implement it, and common pitfalls tested on the exam.
Jump to a section
Imagine you are the chief archivist for a kingdom. You have a single, irreplaceable scroll containing the royal lineage. One night, a fire destroys your archive. The scroll is gone forever. Now, a wise advisor says: 'Never keep just one copy. Keep three copies, on two different materials, with one stored in a different castle.' So you have the original scroll (primary), a parchment copy (secondary), and a wax-tablet copy stored in a tower across the river (off-site). If the archive burns, you still have the parchment copy. If both the archive and the nearby town flood, the wax tablet in the tower survives. The key is that the copies are on different media (parchment vs. wax) and one is physically separated. This mirrors the 3-2-1 backup rule: three copies of your data, on two different media types, with one copy off-site. Just as the archivist cannot rely on a single vault, you cannot rely on a single backup drive. The off-site copy protects against site-wide disasters like fire, flood, or theft. The different media protect against a single point of failure like a bad batch of hard drives. The three copies ensure that even if one copy becomes corrupted during restoration, you have a fallback.
What Is the 3-2-1 Backup Strategy?
The 3-2-1 backup strategy is a data protection rule of thumb that states you should have three copies of your data (one primary and two backups), stored on two different media types, with one copy kept off-site. This strategy ensures that data can be recovered from almost any disaster scenario, including hardware failure, accidental deletion, ransomware, fire, flood, or theft.
Why Three Copies?
Having three copies means you have the original data plus two backups. If the primary copy fails (e.g., hard drive crash), you have one backup to restore from. If that backup is also corrupted or unavailable, you still have a second backup. This redundancy guards against the scenario where a restoration attempt fails due to corruption or media errors. In practice, many organizations use more than three copies, but three is the minimum recommended by industry best practices.
Why Two Different Media Types?
Storing backups on two different media types protects against media-specific failures. For example, if you back up to an external hard drive and also to a cloud service, a failure that affects hard drives (e.g., a bad firmware update) will not affect the cloud backup. Common media pairs include:
Local external hard drive + cloud storage
Network Attached Storage (NAS) + tape backup
USB flash drive + optical disc (less common today)
SSD + HDD (different technologies)
Why One Off-Site Copy?
The off-site copy protects against site-wide disasters that could destroy both the primary data and local backups. Examples include fire, flood, earthquake, theft, or power surge. Off-site can mean a different physical location (e.g., a safe deposit box, a friend's house, a datacenter) or cloud storage in a different geographic region. For home users, off-site often means cloud backup or a drive stored at a relative's home.
How It Works Internally
Implementing 3-2-1 involves creating backup jobs that produce copies on different media. At a high level: 1. Primary copy is the live data on your computer/server. 2. First backup is created to a local medium (e.g., external HDD) using backup software. 3. Second backup is created to a different medium (e.g., cloud) or a separate physical location.
Backup software typically handles scheduling, compression, deduplication, and encryption. For example, using Windows Backup and Restore:
You can schedule a backup to an external drive (medium 1).
Then use a cloud service like OneDrive or Backblaze (medium 2).
Key Components and Defaults
Backup schedule: Determines how often backups occur. Common schedules: daily, weekly, real-time.
Retention policy: How long backups are kept. Example: keep daily backups for 7 days, weekly for 4 weeks, monthly for 12 months.
Backup types: Full, incremental, differential. A full backup copies all data. Incremental copies only changes since last backup (full or incremental). Differential copies changes since last full backup.
Media rotation: For tape backups, a common scheme is Grandfather-Father-Son (GFS).
Encryption: Backups should be encrypted at rest and in transit (e.g., AES-256).
Verification: Some backup software can verify backup integrity by comparing checksums.
Configuration and Verification Commands (Windows)
- wbadmin: Command-line tool for backup and recovery.
- wbadmin start backup -backupTarget:E: -include:C: -allCritical -quiet
- wbadmin get status
- wbadmin get versions
- PowerShell: Backup-WindowsCatalog and Restore-WindowsCatalog.
- Check backup size: Get-ChildItem E:\WindowsImageBackup -Recurse | Measure-Object -Property Length -Sum
Interaction with Related Technologies
RAID is not a backup. RAID protects against drive failure but not against accidental deletion, corruption, or site disaster. RAID should be used in conjunction with 3-2-1.
Snapshots (e.g., VSS on Windows) are point-in-time copies but often stored on the same volume. They are not a substitute for off-site backup.
Cloud backup provides automatic off-site storage. Services like Backblaze, Carbonite, and OneDrive sync are common.
Versioning (e.g., in OneDrive or Google Drive) keeps previous versions of files, which can help against ransomware but still relies on a single medium.
Common Exam Scenarios
A small business has a single external hard drive for backup. This violates the 3-2-1 rule because it uses only one medium and no off-site copy.
A user backs up to an external drive and also to a cloud service. This satisfies 3-2-1 if the cloud counts as off-site and different medium.
A company uses tape backup stored in a fireproof safe on-site. This is not off-site; a fire could destroy both server and tape.
Numbers and Values to Know
3: Number of copies.
2: Number of different media types.
1: Number of off-site copies.
Off-site means physically separate location, not just a different room.
Media types include: HDD, SSD, tape, optical disc, cloud storage, NAS.
Backup types: Full, incremental, differential. Know the differences and storage space requirements.
Trap Patterns on the Exam
Trap: A backup to a second partition on the same drive counts as a separate copy? No, because it is the same physical medium. If the drive fails, both copies are lost.
Trap: RAID 1 (mirroring) satisfies the 'two copies' requirement? No, because it is still one medium type (both drives are HDDs) and typically on-site. Mirroring is not a backup.
Trap: A cloud backup is considered off-site even if the cloud provider's datacenter is in the same city? Yes, it is still off-site because it is a separate physical location.
Trap: Having three copies on three external drives all in the same desk drawer violates the off-site requirement.
Best Practices
Automate backups to avoid human error.
Test restores periodically to ensure backups are valid.
Use encryption for off-site backups to protect data in transit and at rest.
Document the backup and restore procedures.
Monitor backup logs for failures.
Conclusion
3-2-1 is a simple but powerful rule that ensures data survivability. For the 220-1102 exam, you need to be able to evaluate a given scenario and determine if it meets the 3-2-1 rule. Remember: three copies, two media types, one off-site. Anything less is a risk.
Identify Data to Back Up
Determine which data is critical and must be protected. This includes user files, databases, application configurations, and system state. For the exam, know that system state includes registry, boot files, and COM+ class registration database. Prioritize data that cannot be easily replaced. For a typical workstation, this means Documents, Desktop, Pictures, and project files. For a server, it includes databases, email stores, and shared folders. This step sets the scope of the backup.
Choose Two Different Media Types
Select two distinct storage technologies to store the backup copies. Common pairs: external HDD + cloud storage, NAS + tape, or SSD + optical disc. The key is that the media must be different in technology to avoid a single point of failure. For example, if both copies are on HDDs from the same batch, a manufacturing defect could affect both. Cloud storage counts as a different medium because it uses a different infrastructure (often SSD arrays with redundancy). On the exam, recognize that two external HDDs are the same medium, violating the '2' rule.
Create the First Backup on Local Medium
Perform the first backup to a local medium, such as an external hard drive or NAS. This backup is typically a full backup initially, followed by incremental or differential backups. The local backup provides fast recovery for common failures like accidental deletion or drive failure. Use backup software to schedule this automatically. For Windows, you can use File History or Backup and Restore. The local medium should be kept in a secure location, but it is still on-site.
Create the Second Backup on Different Medium
Create the second backup on a different medium, preferably off-site. This could be a cloud backup service (e.g., Backblaze, Carbonite) or a physical drive that is taken off-site. The second backup should be independent of the first. For cloud backups, the data is transmitted over the internet and stored in a remote datacenter. This ensures that even if the local site is destroyed, the data survives. Ensure the backup is encrypted before transmission.
Store One Copy Off-Site
The off-site copy must be physically separated from the primary site. For cloud backups, this is inherent. For physical media, it means transporting the drive to a different building, a safe deposit box, or a friend's house. The off-site location should be geographically diverse to avoid regional disasters. For example, if the primary site is in a flood zone, the off-site should be on higher ground. The exam often tests that a fireproof safe on-site does not count as off-site.
Verify and Test Backups Regularly
Periodically verify that backups are restorable. This involves performing a test restore to a separate location or using backup software's verification feature. Verification checks the integrity of backup files by comparing checksums or by doing a trial restoration. Without verification, a backup may be corrupt and useless. The exam emphasizes that a backup is only good if it can be restored. Schedule monthly or quarterly test restores.
Enterprise Scenario 1: Small Law Firm
A small law firm with 10 employees handles sensitive client documents. They implemented 3-2-1 as follows: Primary data is on a local server with RAID 1 (two HDDs). Backup 1 is a daily full backup to a NAS (Network Attached Storage) in the same office. Backup 2 is a nightly cloud backup to a service with AES-256 encryption. The cloud backup is off-site. This satisfies 3-2-1 because there are three copies (server, NAS, cloud), two media types (HDD in server and NAS, cloud storage), and one off-site (cloud). The firm also tests restores quarterly. A common issue they faced was the cloud backup failing due to slow upload speeds; they resolved it by scheduling backups during off-hours.
Enterprise Scenario 2: E-commerce Company
An e-commerce company with 50 servers uses 3-2-1 for their database. They have: Primary copy on SSD RAID 10. Backup 1: daily full backup to a tape library on-site. Backup 2: continuous backup to a second datacenter 500 miles away via replication. This uses two media types (SSD and tape) and two locations (on-site tape and off-site datacenter). However, they initially made the mistake of using the same tape brand for all backups, which violated the '2 media types' rule because tape is one type. They corrected by adding a cloud backup as a third medium. The exam might present a scenario where a company uses two different tape drives but both are tape – that is one medium type.
Common Misconfigurations
All backups on same medium: Using three external HDDs all in the same office. If a power surge fries all drives, data is lost.
No off-site copy: A business keeps backup tapes in a fireproof safe on-site. A fire could destroy both server and tapes.
Not testing restores: A company backs up daily but never tests. When a ransomware attack hit, they discovered the backup software had been failing for months due to a configuration error.
Performance and Scale Considerations
For large datasets, full backups take time and bandwidth. Use incremental or differential backups to reduce backup window.
Cloud backups may be throttled by ISP; consider seeding (sending initial backup via physical drive).
Encryption adds CPU overhead; ensure backup server has sufficient resources.
Retention policies must align with legal requirements (e.g., 7 years for financial records).
What the 220-1102 Exam Tests
Objective 4.3 (Implement backup and recovery methods) specifically tests your ability to apply the 3-2-1 rule to given scenarios. You must be able to identify whether a backup plan meets the rule and recommend improvements. The exam does not ask you to configure backup software, but you need to know the concepts.
Most Common Wrong Answers and Why
RAID 1 counts as two copies: Candidates think mirroring provides two copies, but RAID is not a backup. It protects against drive failure but not accidental deletion or corruption. Also, both drives are the same medium type and on-site.
Two external hard drives in the same location satisfy the rule: This gives three copies (primary + two HDDs) but uses only one medium type (HDD) and no off-site copy. The exam will present this as a trap.
A backup to a second partition on the same drive counts as a separate copy: No, because it is the same physical drive. If the drive fails, both partitions are lost.
Cloud backup is not considered off-site because it's 'virtual': Cloud is physically off-site; it is a valid off-site copy.
Specific Numbers and Terms
3-2-1 rule: Three copies, two media types, one off-site.
Media types: HDD, SSD, tape, optical disc, cloud, NAS.
Off-site: Physically separate location; not just a different room.
Full backup: Copies all selected data.
Incremental backup: Copies only data changed since last backup (full or incremental).
Differential backup: Copies data changed since last full backup.
Edge Cases the Exam Loves
What if the off-site copy is on the same medium type as the on-site copy? Example: Two external HDDs, one kept in the office, one in a safe deposit box. This satisfies off-site but not two different media types. Still violates the rule.
What if you have four copies but only one medium type? Violates the '2' rule.
What if the off-site copy is on a different medium but the on-site copies are both on the same medium? Example: Primary on SSD, backup on external HDD (on-site), second backup on tape (off-site). This satisfies 3-2-1 because there are three copies (SSD, HDD, tape), two media types (SSD/HDD are both magnetic? Actually SSD is flash, HDD is magnetic – they are different types. But tape is also magnetic. So careful: SSD and HDD are different media types? The exam considers HDD and SSD as different because they use different technology. But HDD and tape are both magnetic? Typically, the exam treats them as different because the form factor and access method differ. The key is that they are not identical.
How to Eliminate Wrong Answers
If the scenario mentions only one backup medium (e.g., 'external hard drive'), eliminate any answer that claims it meets 3-2-1.
If the scenario mentions two backups but both are on-site (e.g., 'both backups are in the server room'), eliminate answers that say off-site requirement is met.
If the scenario mentions RAID as a backup, eliminate that option.
Look for the phrase 'different media' – if the scenario says 'two different external hard drives', that is the same medium.
Exam Tips
Memorize the three numbers and what each represents.
Practice evaluating scenarios: count copies, identify media types, check off-site.
Remember: Backup is not the same as sync or RAID.
The 3-2-1 rule mandates three copies, two different media types, and one off-site copy.
RAID is not a backup; it provides redundancy but not protection against deletion or disaster.
Different media types include HDD, SSD, tape, optical disc, cloud, and NAS.
Off-site means a physically separate location, not just a different room or fireproof safe on-site.
Backup types: Full (all data), Incremental (changes since last backup), Differential (changes since last full backup).
Always test restores periodically to ensure backup integrity.
Encrypt backups, especially off-site copies, to protect sensitive data.
Automate backups to reduce human error.
Retention policies determine how long backups are kept; consider legal requirements.
Cloud backups count as off-site and a different medium from local storage.
These come up on the exam all the time. Here's how to tell them apart.
3-2-1 Backup Strategy
Three copies of data (primary + two backups)
Two different media types (e.g., HDD and cloud)
One copy stored off-site
Protects against hardware failure, corruption, and site disasters
Requires more storage and management overhead
Simple Single Backup
Only one backup copy (primary + one backup)
Often uses a single medium type (e.g., external HDD)
Backup is typically stored on-site
Vulnerable to site-wide disasters like fire or flood
Simpler to set up but high risk of data loss
Mistake
RAID 1 (mirroring) satisfies the 'three copies' requirement because it creates an exact duplicate of the data.
Correct
RAID 1 provides only two copies (primary and mirror), not three. More importantly, RAID is not a backup; it protects against drive failure but not against accidental deletion, corruption, or site disaster. Both copies are on the same medium type (HDD) and typically on-site. RAID should be used in addition to, not in place of, a 3-2-1 backup strategy.
Mistake
A backup to a second partition on the same physical drive counts as a separate copy.
Correct
A second partition is on the same physical disk. If the disk fails, both partitions are lost. The 3-2-1 rule requires copies to be on separate physical media. A partition is not a separate medium.
Mistake
Cloud storage is not considered off-site because it is accessed over the internet and is not physically separate.
Correct
Cloud storage is physically located in a remote datacenter, often in a different geographic region. It is absolutely considered off-site. The data is stored on servers owned by the cloud provider, which are separate from the local site.
Mistake
Having three copies of data on three different external hard drives all stored in the same desk drawer satisfies the 3-2-1 rule.
Correct
This violates two parts of the rule: all three copies are on the same medium type (external HDDs), and none are off-site. If a fire or flood destroys the desk, all copies are lost. The rule requires at least two different media types and one off-site copy.
Mistake
A backup strategy that includes a full backup every week and daily incremental backups to the same external drive meets the 3-2-1 rule.
Correct
This provides only one backup medium (the external drive) and no off-site copy. The incremental backups are additional copies on the same drive, not separate mediums. This is a single point of failure.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
The 3-2-1 backup rule is a data protection strategy that states you should have three copies of your data (one primary and two backups), stored on two different media types, with one copy kept off-site. This ensures recoverability from hardware failures, accidental deletions, and site-wide disasters. For example, you might have your primary data on your computer (copy 1), a backup on an external hard drive (copy 2, medium 1), and another backup in the cloud (copy 3, medium 2, off-site).
No, RAID does not count as a backup. RAID (e.g., RAID 1 mirroring) provides fault tolerance against drive failure but does not protect against accidental deletion, file corruption, ransomware, or site-wide disasters. RAID is a component of high availability, not a substitute for a backup. The 3-2-1 rule requires separate copies on different media, with one off-site, which RAID cannot provide.
Two different media types mean using two distinct storage technologies to avoid a single point of failure. Common pairs include: external hard drive (HDD) and cloud storage; SSD and tape; NAS (network storage) and optical disc. The key is that the media must be different in technology, not just different brands. For example, two different external HDDs are the same medium type.
No, a second partition on the same physical drive does not count as a separate copy because the entire drive is a single point of failure. If the drive fails, both partitions are lost. The 3-2-1 rule requires copies on separate physical media. A partition is not a separate medium.
Yes, cloud storage is considered off-site because the data is physically stored in a remote datacenter, often in a different geographic region. It meets the off-site requirement as long as the cloud provider's infrastructure is separate from your local site. However, ensure you encrypt the data before uploading to protect it in transit and at rest.
An incremental backup copies only the data that has changed since the last backup (whether full or incremental). A differential backup copies all data changed since the last full backup. Incremental backups are faster and use less space, but restore requires the last full backup plus all subsequent incrementals. Differential backups are slower and larger but restore requires only the last full backup and the latest differential.
You should test your backups at least quarterly, but more frequently for critical data. Testing involves performing a trial restoration to verify that the backup files are not corrupted and that the data can be recovered. Without testing, you might discover a backup failure only when you need it most. The exam emphasizes that a backup is only as good as its ability to be restored.
You've just covered 3-2-1 Backup Strategy — now see how well it sticks with free 220-1102 practice questions. Full explanations included, no account needed.
Done with this chapter?