SY0-701 Security Operations Practice Question
A branch office stores nightly backups on a NAS that is joined to the same Active Directory domain as the production servers. After a ransomware incident, management wants a backup design that is much harder for attackers to encrypt or delete. Which approach is the best improvement?
⚠ Common exam trap
It's easy for candidates to assume increasing backup frequency or keeping backups on the same network segment improves recovery speed, but they overlook the fundamental need for isolation and immutability to protect against ransomware encryption and deletion.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Maintain an offline or immutable backup copy in a separate administrative boundary.
Maintaining an offline or immutable backup copy in a separate administrative boundary ensures that attackers cannot encrypt or delete the backups, even if they compromise the Active Directory domain. An offline backup (e.g., tape or disconnected disk) is physically isolated, while immutable backups (e.g., using S3 Object Lock or a NAS with WORM capabilities) prevent modification or deletion for a defined retention period. This design breaks the attacker's ability to propagate ransomware to the backup repository, addressing the core requirement of making backups much harder to encrypt or delete.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Increase the backup frequency to every hour while keeping the same NAS design.
Why it's wrong here
Increasing the backup frequency to every hour does nothing to protect the backup data from a compromised domain. Because the NAS is domain-joined, an attacker with domain admin or equivalent privileges can directly access, encrypt, or delete all backup files regardless of how recently they were written. Hourly backups only reduce the recovery point objective (RPO), but they leave the same single point of failure: the backups remain on the same logical trust boundary as the production environment, so they are just as vulnerable to ransomware or malicious deletion.
- ✗
Store all backups on the same network segment for faster restore access.
Why it's wrong here
Storing all backups on the same network segment as production hosts eliminates logical network isolation, allowing an attacker who compromises any production system to use lateral movement to reach the backup storage. The faster restore access is irrelevant when the backups themselves can be encrypted by the same ransomware that hit the production VLAN. A proper backup architecture places repositories on a separate network segment with strict firewall rules and independent access controls, ensuring that a breach of the production network cannot directly reach the restore source.
- ✓
Maintain an offline or immutable backup copy in a separate administrative boundary.
Why this is correct
An offline or immutable backup copy in a separate administrative boundary is the correct strategy because it removes the backup from the domain's trust and permission model. Offline backups are physically or logically air-gapped, while immutable backups (e.g., WORM storage or object lock) prevent even a compromised administrator from modifying or deleting data within the retention window. The separate administrative boundary ensures that an attacker who takes over the production domain cannot leverage those credentials to reach the backup, preserving a known-good recovery point for incident response and disaster recovery.
- ✗
Use only snapshots on the production storage array because they are instant to restore.
Why it's wrong here
Using only snapshots on the production storage array is insufficient because snapshots are stored on the same array and are managed through the storage system's administrative plane. If an attacker compromises the domain and subsequently gains access to storage administration credentials (or exploits a storage console vulnerability), snapshots can be deleted, deliberately destroyed, or left exposed to encryption at the underlying volume level. Snapshots also typically share the same performance infrastructure and lack the physical separation or immutability controls of a properly isolated backup solution, so they are not a dependable resilience mechanism against a targeted attack.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
Learn chapter
Identity and Access Management
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
Key term
Worm
A worm is a type of malicious software that can copy itself and spread to other computers over a network, often without any human action.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.