This chapter covers Disaster Recovery Planning (DRP), a critical component of the Operational Procedures domain (Objective 4.3) in the CompTIA A+ 220-1102 exam. DRP ensures that an organization can recover from major disruptions such as natural disasters, cyberattacks, hardware failures, or human error. Expect approximately 5–8% of the exam questions to touch on DRP concepts, including backup types, recovery sites, and plan testing. Mastery of this topic is essential not only for the exam but also for real-world IT roles where data loss or downtime can cost millions.
Jump to a section
Disaster Recovery Planning (DRP) is like a fire drill for your entire business. Imagine a large office building with hundreds of employees, critical servers, and irreplaceable paper records. A fire drill isn't just about knowing where the exits are; it's a coordinated plan that includes: (1) an early warning system (smoke detectors and alarms) that detects the fire and alerts everyone, (2) a designated assembly point where employees gather and are accounted for, (3) a backup of critical documents stored in a fireproof safe or offsite, and (4) a plan to resume operations in a temporary location if the building is destroyed. In IT, the smoke detector is your monitoring and alerting system; the assembly point is your backup data center or cloud failover; the fireproof safe is your offline backup or tape library; and the temporary location is your disaster recovery site. Just as a fire drill must be practiced regularly to ensure everyone knows their role and the plan works under pressure, a DRP must be tested through tabletop exercises and full-scale simulations. Without a drill, people panic, miss exits, and fail to account for everyone—without DRP testing, recovery times blow past objectives, data is lost, and business operations grind to a halt.
What is Disaster Recovery Planning (DRP)?
Disaster Recovery Planning (DRP) is a documented, structured approach that describes how an organization can quickly resume work after an unplanned incident. It is a subset of Business Continuity Planning (BCP). While BCP focuses on maintaining business operations during a disruption (e.g., employees working from home), DRP specifically deals with restoring IT infrastructure and data after a disaster. The 220-1102 exam expects you to understand the key components of a DRP, including backup strategies, recovery sites, and testing procedures.
Why DRP Exists
Disasters are inevitable. They can be natural (earthquakes, floods, fires), man-made (cyberattacks, sabotage, accidental deletions), or technical (hardware failures, power outages). Without a DRP, organizations face:
Data Loss: Permanent loss of critical business data.
Downtime: Extended periods where systems are unavailable, leading to revenue loss and reputational damage.
Compliance Violations: Many industries (healthcare, finance) require documented DRPs.
Legal Liability: Failure to recover data may breach contracts or regulations.
The DRP defines Recovery Time Objective (RTO) and Recovery Point Objective (RPO). RTO is the maximum acceptable downtime—how fast you need to recover. RPO is the maximum acceptable data loss—how far back in time you can afford to lose data (e.g., 1 hour, 24 hours). These metrics drive the choice of backup methods and recovery sites.
Key Components of a DRP
A comprehensive DRP includes:
Policy Statement: Scope, objectives, and responsibilities.
Risk Assessment: Identifies threats and vulnerabilities.
Business Impact Analysis (BIA): Determines critical systems and their RTO/RPO.
Recovery Strategies: Backup methods, recovery sites, and procedures.
Plan Testing and Maintenance: Regular drills and updates.
Communication Plan: Who to contact and how.
Backup Types and Strategies
Backups are the foundation of DRP. The exam tests the following backup types:
Full Backup: Copies all selected data. Slowest to create but fastest to restore. Requires the most storage. Typically performed weekly.
Incremental Backup: Copies only data changed since the last backup (full or incremental). Fastest to create, uses least storage. Restore requires the last full backup and all subsequent incremental backups in order. Example: Full on Sunday, incremental Mon–Sat. To restore Friday’s data, you need Sunday full + Mon, Tue, Wed, Thu, Fri incrementals.
Differential Backup: Copies data changed since the last full backup. Faster to create than full, but slower than incremental. Restore requires the last full backup and the latest differential backup. Example: Full on Sunday, differential Mon–Sat. To restore Friday’s data, you need Sunday full + Friday differential.
Exam Tip: Know the trade-offs. Incremental saves time and space but complicates restore. Differential balances speed and restore simplicity. Full is simplest but resource-intensive.
Backup Locations and Media
On-site: Local tape drives, external hard drives, NAS. Fast restore but vulnerable to same disaster (fire, flood).
Off-site: Physical storage at a different location (e.g., Iron Mountain). Protects against site-level disasters.
Cloud: Remote backup services (e.g., AWS S3, Azure Backup). Scalable, accessible from anywhere, but dependent on internet bandwidth.
Tape: Magnetic tape cartridges. Durable, cheap, but slow. Commonly used for archival backups.
Optical Discs: CD/DVD/Blu-ray. Low capacity, slow, rarely used today.
External Hard Drives: Fast, portable, but can be lost or stolen.
Network Attached Storage (NAS): Centralized network storage. Convenient but vulnerable to ransomware.
Recovery Sites
If a disaster destroys the primary data center, where do you recover? Three types of recovery sites are tested:
Hot Site: Fully equipped data center with servers, storage, networking, and live data synchronized with the primary site. RTO can be minutes to hours. Most expensive.
Warm Site: Partially equipped; has hardware but may not have real-time data. RTO typically a few days. Moderate cost.
Cold Site: Empty building with power, cooling, and cabling. No hardware or data. RTO weeks or more. Least expensive.
Exam Tip: The exam often asks which site to choose based on RTO/RPO. A hot site is needed for critical systems with low RTO (e.g., banking). A cold site is acceptable for non-critical systems with long RTO.
Plan Testing and Maintenance
A DRP is useless if untested. Common testing methods:
Tabletop Exercise: Key personnel walk through the plan step-by-step in a meeting room. No actual systems are touched. Identifies gaps and outdated steps.
Simulation: A mock disaster scenario is enacted. May involve some system testing without disrupting production. Example: Restore a backup to a test server.
Parallel Testing: The recovery site is brought online alongside the primary site. Both run simultaneously to verify functionality.
Full Interruption Test: Production is shut down and operations are moved to the recovery site. Most realistic but risky. Rarely done except in mission-critical environments.
The plan should be reviewed and updated at least annually, or whenever significant infrastructure changes occur (new applications, hardware upgrades, personnel changes).
DRP vs. BCP
BCP (Business Continuity Planning): Focuses on keeping the business operational during a disruption. Includes alternative work arrangements, communication plans, and supply chain continuity. Broader scope.
DRP (Disaster Recovery Planning): Focuses on restoring IT systems and data after a disaster. Narrower, technical scope.
Common Disaster Scenarios
Natural Disasters: Flood, fire, earthquake, hurricane. Require off-site backups and geographically dispersed recovery sites.
Cyberattacks: Ransomware, malware, DDoS. Backups must be immutable (write-once, read-many) and offline to prevent encryption.
Hardware Failure: RAID failure, power supply failure. Redundant hardware and regular backups mitigate.
Human Error: Accidental deletion, misconfiguration. Frequent backups and versioning help.
Power Outage: UPS and generators provide temporary power; DRP covers extended outages.
Encryption and Security of Backups
Backups contain sensitive data. They must be encrypted both in transit (TLS, IPsec) and at rest (AES-256). Access controls should limit who can restore data. The 3-2-1 backup rule is a best practice: keep at least 3 copies of data, on 2 different media types, with 1 copy off-site.
Configuration and Verification Commands (Windows)
While the 220-1102 exam does not require deep command-line skills, knowing basic backup verification is useful:
wbadmin get versions: Lists available backup versions.
wbadmin get items -version:MM/DD/YYYY-HH:MM: Lists items in a specific backup.
wbadmin start recovery -version:... -itemType:File -items:C:\Data: Recovers specific files.
For cloud backups, verify using the provider's console or CLI (e.g., aws s3 ls to list S3 buckets).
How DRP Interacts with Other Technologies
RAID: Provides fault tolerance against disk failure but is not a backup. RAID protects against hardware failure; DRP protects against site-level disasters.
UPS: Protects against short power outages; DRP covers prolonged outages.
Virtualization: Snapshots and VM replication simplify recovery. DRP may involve restoring VMs from backups or failing over to a secondary hypervisor.
Cloud Services: IaaS, PaaS, SaaS have built-in DR features (e.g., AWS Availability Zones, Azure Site Recovery). DRP must account for cloud dependencies.
Step-by-Step: Creating a DRP
Risk Assessment: Identify threats (fire, flood, cyberattack) and their likelihood.
Business Impact Analysis: Determine critical systems, RTO, RPO.
Define Recovery Strategies: Choose backup types, recovery sites, and tools.
Document the Plan: Write procedures, contact lists, and escalation paths.
Test the Plan: Conduct tabletop exercises and full-scale tests.
Maintain the Plan: Update regularly based on tests and infrastructure changes.
Exam-Specific Details
RTO vs. RPO: RTO is time to recover; RPO is maximum data loss. Example: RTO=4 hours means systems must be up within 4 hours. RPO=1 hour means you can lose at most 1 hour of data.
Backup Rotation Schemes: Grandfather-Father-Son (GFS) is common: daily (son), weekly (father), monthly (grandfather).
On-site vs. Off-site: Off-site protects against physical disasters at the primary site.
Cloud Backup: Also known as backup as a service (BaaS). Pay-as-you-go, scalable.
Common Exam Traps
Confusing RTO and RPO: RTO is about downtime; RPO is about data loss. A low RPO means frequent backups (e.g., continuous replication).
Thinking RAID replaces backups: RAID protects against disk failure, not accidental deletion or corruption.
Assuming hot sites are always the answer: Hot sites are expensive; warm or cold sites are acceptable for less critical systems.
Neglecting off-site backups: On-site backups alone are insufficient if the building is destroyed.
Forgetting to test: An untested plan is worthless. The exam may ask which testing method is least disruptive (tabletop).
Conduct Risk Assessment
Identify all potential threats to IT infrastructure: natural disasters (floods, earthquakes), man-made (ransomware, sabotage), and technical failures (power outage, hardware crash). For each threat, estimate likelihood (e.g., high/medium/low) and potential impact (data loss, downtime, financial cost). This step produces a risk register that prioritizes which scenarios the DRP must address. For example, a data center in a flood zone must have off-site backups and a recovery site outside the flood plain.
Perform Business Impact Analysis (BIA)
Determine which systems are critical to business operations and quantify the maximum tolerable downtime (RTO) and data loss (RPO) for each. Interview department heads to understand dependencies. For instance, an e-commerce website may have RTO=1 hour and RPO=15 minutes, while an internal wiki may have RTO=24 hours and RPO=1 day. The BIA also identifies regulatory requirements (e.g., HIPAA mandates 30-day backup retention).
Define Recovery Strategies
Based on RTO/RPO, choose backup methods (full, incremental, differential) and media (tape, cloud, disk). Select a recovery site: hot site for low RTO (minutes/hours), warm site for moderate RTO (days), cold site for long RTO (weeks). Also decide on replication method: synchronous replication for near-zero RPO (but requires low latency between sites), asynchronous for longer distances. Document the strategy, including backup frequency and retention policy.
Document the Plan
Write a detailed DRP document that includes: executive summary, scope, roles and responsibilities (who declares a disaster, who restores backups), step-by-step recovery procedures for each critical system, communication plan (contact lists, escalation paths), and inventory of hardware/software needed at the recovery site. Include copies of backup schedules, encryption keys, and vendor support contracts. Store the document securely both on-site and off-site.
Test the Plan
Conduct regular tests to validate the plan. Start with tabletop exercises: gather stakeholders and walk through scenarios. Then progress to simulation tests: restore a backup to a test environment. Eventually perform a full interruption test if feasible. Document test results, noting any failures or deviations. For example, if restore took 6 hours but RTO is 4 hours, the plan must be adjusted (e.g., use faster storage or parallel restore).
Maintain and Update Plan
Review the DRP at least annually or after significant changes (new applications, hardware upgrades, personnel changes). Update contact lists, backup configurations, and recovery procedures. If a test reveals a gap, revise the plan immediately. Also incorporate lessons learned from actual incidents. For example, after a ransomware attack, you might add offline backups and air-gapped storage to the plan.
Enterprise Scenario 1: Financial Services Firm
A large bank must comply with regulatory requirements (e.g., SEC Rule 17a-4) that mandate rapid recovery of trading systems. Their RTO for the trading platform is 15 minutes; RPO is 1 minute. They deploy a hot site in a different geographic region with synchronous data replication. The primary data center in New York replicates to a hot site in Chicago using dedicated fiber links. Every night, a full backup is taken to tape and shipped to a third-party vault. The DRP is tested quarterly with a full failover exercise where trading is actually routed to Chicago for one hour. A common issue is replication lag due to high transaction volume; they monitor latency and have automated alerts if replication falls behind. The cost of the hot site is justified by the potential revenue loss of $5 million per hour of downtime.
Enterprise Scenario 2: Healthcare Provider
A regional hospital network uses an Electronic Health Record (EHR) system with RTO of 4 hours and RPO of 1 hour. They use a warm site at a colocation facility 200 miles away. Backups are performed hourly to a local NAS, then replicated to the warm site every 4 hours. They also perform daily full backups to tape, which are stored off-site. The DRP includes a detailed procedure for restoring the EHR database, which involves verifying data integrity and reconnecting peripheral systems (lab, pharmacy). During a recent ransomware attack, backups were encrypted because they were on the same network. They revised the DRP to include immutable cloud backups (AWS S3 with Object Lock) and an air-gapped tape backup. The warm site was activated within 6 hours—slightly over the 4-hour RTO—prompting an upgrade to faster storage.
Enterprise Scenario 3: E-commerce Company
An online retailer with global customer base uses a cloud-first strategy. Their DRP leverages AWS Availability Zones (AZs) and cross-region replication. RTO for the web tier is 5 minutes; RPO is near zero using synchronous replication for the database. They use a pilot light approach: core services (DNS, load balancers, database replicas) run in a secondary region but are scaled down. During a disaster, they scale up the secondary region and redirect traffic. Automated scripts handle failover using AWS Route 53 health checks. They test DR every month by simulating an AZ failure. A common misconfiguration is not updating security groups in the secondary region, causing connectivity issues after failover. They now use Infrastructure as Code (Terraform) to ensure both regions are identical. The cost is higher than a cold site but acceptable given the revenue per minute of uptime.
What the 220-1102 Exam Tests
Objective 4.3 (Operational Procedures) explicitly requires you to "compare and contrast disaster recovery concepts." The exam focuses on:
Backup types: Full, incremental, differential. Know the speed, storage, and restore implications.
Recovery sites: Hot, warm, cold. Associate each with appropriate RTO/RPO.
RTO vs. RPO: Be able to define both and apply them to scenarios.
Testing methods: Tabletop, simulation, parallel, full interruption. Know which is least/most disruptive.
On-site vs. off-site backups: Understand the trade-offs.
3-2-1 rule: 3 copies, 2 media, 1 off-site.
Common Wrong Answers and Why
"Differential backups are faster to restore than incremental." This is true, but candidates often think the opposite. Incremental restore requires all incrementals since last full; differential requires only the last full and the latest differential. So differential is faster to restore.
"A cold site is best for critical systems." Wrong—cold sites have no hardware and take weeks to set up. Hot sites are for critical, low-RTO systems.
"RPO is the time to recover." This confuses RPO with RTO. RPO is data loss (how much data you can afford to lose), measured in time. RTO is downtime.
"Full backups are the most efficient for daily use." Full backups consume the most time and storage; incremental or differential are more efficient for daily backups.
"Testing is optional if the plan is well-written." The exam emphasizes that testing is mandatory. A plan that hasn't been tested is unreliable.
Specific Numbers and Terms on the Exam
RTO and RPO: You may be given a scenario and asked to choose the appropriate backup frequency or recovery site. Example: RTO=2 hours, RPO=1 hour. Answer: Use a hot site with hourly backups.
Backup rotation: GFS (Grandfather-Father-Son) is a common term. Grandfather = monthly, Father = weekly, Son = daily.
3-2-1 rule: The exam may ask what it stands for or why it's important.
Tabletop exercise: The least disruptive testing method.
Full interruption test: The most disruptive and realistic.
Edge Cases and Exceptions
Incremental vs. differential: If backups are taken daily and a disaster occurs on Friday, with a full backup on Sunday: incremental restore requires Sunday full + Mon + Tue + Wed + Thu + Fri incremental. Differential restore requires Sunday full + Friday differential. So differential is faster to restore, but incremental uses less storage daily.
Cloud backups: The exam may present a scenario where an organization uses both on-site and cloud backups. Cloud is often considered off-site, but if the cloud provider is in the same region as the primary site, it may not protect against regional disasters.
Ransomware: Backups must be immutable or offline to prevent encryption. The exam may ask which backup method protects against ransomware (air-gapped or write-once media).
How to Eliminate Wrong Answers
Use the underlying mechanism: For restore speed, think about the number of tapes/backups you need to apply. Incremental requires many; differential requires two. For recovery site, think about what is present: hot has everything, cold has nothing. For RTO/RPO, remember: RTO = time to recover (downtime), RPO = time between backups (data loss). If a question says "the maximum amount of data that can be lost is 1 hour," that's RPO=1 hour. If it says "systems must be back online within 4 hours," that's RTO=4 hours.
DRP focuses on restoring IT systems after a disaster; BCP focuses on keeping business operations running.
RTO (Recovery Time Objective) is maximum acceptable downtime; RPO (Recovery Point Objective) is maximum acceptable data loss.
Full backup copies all data; incremental copies data changed since last backup; differential copies data changed since last full backup.
Incremental is fastest to create but slowest to restore; differential is slower to create but faster to restore than incremental.
Hot site has active hardware and data (low RTO); warm site has hardware but may not have current data; cold site has no hardware (high RTO).
The 3-2-1 backup rule: keep 3 copies of data, on 2 different media types, with 1 copy off-site.
DRP must be tested regularly; tabletop exercises are least disruptive, full interruption tests are most realistic.
Off-site backups protect against physical disasters at the primary site; on-site backups are faster to restore but vulnerable.
RAID is not a backup; it provides fault tolerance against disk failure only.
Backups should be encrypted and stored securely; immutable or air-gapped backups protect against ransomware.
These come up on the exam all the time. Here's how to tell them apart.
Incremental Backup
Backs up only data changed since last backup (full or incremental).
Fastest to create; smallest storage footprint per backup.
Restore requires last full backup plus all subsequent incrementals.
Slower restore compared to differential.
Commonly used in environments where backup window is tight and storage is limited.
Differential Backup
Backs up data changed since last full backup only.
Slower to create than incremental but faster than full; moderate storage use.
Restore requires last full backup plus the latest differential.
Faster restore than incremental (only two backups needed).
Preferred when restore speed is more important than backup speed.
Hot Site
Fully equipped with servers, storage, networking, and live data.
RTO can be minutes to hours.
Most expensive option due to continuous operation and data replication.
Data is synchronized in real-time or near-real-time.
Ideal for mission-critical systems with low RTO/RPO.
Cold Site
Empty building with power, cooling, and cabling but no hardware.
RTO is weeks or more; requires procurement and setup.
Least expensive option; pay only for facility.
No data or equipment until disaster declared.
Suitable for non-critical systems with high RTO.
Mistake
RAID is a form of backup.
Correct
RAID provides fault tolerance against disk failure but does not protect against accidental deletion, corruption, ransomware, or site-level disasters. RAID is not a backup; it is high availability. Backups must be separate copies, ideally off-site.
Mistake
Incremental backups are faster to restore than differential backups.
Correct
Differential backups are faster to restore because you only need the last full backup and the latest differential. Incremental restore requires the last full backup plus every incremental backup taken since then. Incremental is faster to create but slower to restore.
Mistake
A cold site is suitable for critical systems with low RTO.
Correct
A cold site has no hardware, no data, and no active connectivity. Setting up a cold site takes weeks, so it is only suitable for non-critical systems with RTO measured in weeks. Critical systems with low RTO (minutes/hours) require a hot or warm site.
Mistake
Once a DRP is written, it doesn't need to be tested.
Correct
A DRP must be tested regularly to identify gaps, outdated procedures, and personnel changes. Without testing, the plan may fail during a real disaster. The CompTIA exam emphasizes that testing is a critical component of DRP.
Mistake
RPO is the time it takes to recover systems.
Correct
RPO (Recovery Point Objective) is the maximum acceptable data loss, measured in time (e.g., 1 hour). RTO (Recovery Time Objective) is the maximum acceptable downtime. Confusing these is a common exam mistake.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
RTO (Recovery Time Objective) is the maximum amount of time that a system can be down after a disaster—essentially, how quickly you need to recover. RPO (Recovery Point Objective) is the maximum amount of data loss you can tolerate, measured in time—essentially, how far back in time you can afford to lose data. For example, if RTO is 4 hours, you must have systems running within 4 hours. If RPO is 1 hour, you can lose at most 1 hour of data (so backups must be taken at least hourly). Exam tip: RTO = time to recover, RPO = point in time to which data is recovered.
A full backup is fastest to restore because you only need to restore one backup set. However, full backups are slow to create and consume the most storage. Among incremental and differential, differential is faster to restore than incremental because you only need the last full backup and the latest differential backup. Incremental restore requires the last full backup plus every incremental backup taken since then. Exam tip: If the question asks about restore speed, think about how many backup sets you need to apply.
A tabletop exercise is a discussion-based test where key stakeholders (IT staff, management, communications) gather in a room and walk through a disaster scenario step by step. No actual systems are touched or data restored. It is the least disruptive and least expensive testing method. Its purpose is to identify gaps in the plan, outdated contact information, and unclear roles. The exam often presents this as the recommended first step in testing a DRP.
For a critical database with a low RTO (e.g., 1 hour) and low RPO (e.g., 15 minutes), you need a hot site. A hot site has fully operational hardware and live data synchronized from the primary site. A cold site has no hardware and would take weeks to set up, which would far exceed the RTO. Use a cold site only for non-critical systems where downtime of weeks is acceptable. Exam tip: Match the recovery site to the RTO: hot for minutes/hours, warm for days, cold for weeks.
The 3-2-1 rule is a best practice for backup strategy: Keep at least 3 copies of your data (one primary and two backups), store them on 2 different types of media (e.g., tape and cloud, or external hard drive and NAS), and ensure at least 1 copy is stored off-site (geographically separate from the primary data). This protects against multiple failure scenarios: hardware failure, media corruption, and site-level disasters. The exam may ask what the 3-2-1 rule is or why it's important.
No. RAID (Redundant Array of Independent Disks) provides fault tolerance against a single disk failure, but it does not protect against data corruption, accidental deletion, ransomware, or a catastrophic event like a fire or flood. If a file is accidentally deleted, RAID does not help—the deletion is mirrored across all disks. Backups are separate copies that can be restored to a point in time before the deletion. Always maintain backups in addition to RAID.
Business Continuity Planning (BCP) is the broader process of ensuring that critical business functions can continue during and after a disaster. It includes alternative work arrangements, supply chain continuity, and communication plans. Disaster Recovery Planning (DRP) is a subset of BCP that specifically focuses on restoring IT infrastructure and data after a disaster. BCP answers 'how do we keep the business running?' while DRP answers 'how do we get our systems back online?'
You've just covered Disaster Recovery Planning — now see how well it sticks with free 220-1102 practice questions. Full explanations included, no account needed.
Done with this chapter?