SY0-701 Security Operations Practice Question
A branch office uses a NAS for nightly backups, but the NAS is joined to the same domain as the production servers. After ransomware encrypted both production data and backups, management wants the most effective change to reduce the chance of backup tampering without a major redesign. Which control should be implemented?
⚠ Common exam trap
It's easy for candidates to choose more frequent backups or larger storage, thinking that having more copies or more space provides protection, when the real vulnerability is the shared domain trust that allows ransomware to access and encrypt backups.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Keep one backup copy offline or immutable and outside the production domain.
Keeping one backup copy offline or immutable and outside the production domain ensures that even if ransomware compromises the domain, it cannot encrypt or tamper with that isolated copy. This breaks the chain of trust between the production environment and the backup storage, directly addressing the root cause of the incident.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Increase the retention period so deleted files can be recovered for longer.
Why it's wrong here
Extending retention typically means backups are purged less often, but it does not enforce immutability or access restrictions on the NAS. If ransomware gains the same privileges as the backup service account, it can modify or encrypt all retained backup versions, rendering the longer retention useless for recovery. Furthermore, an attacker that deletes or cryptolocks the NAS volume will also destroy the longer history, so retention alone cannot provide a trustworthy recovery source. The real need is to isolate and protect the backup target, not to simply keep data longer on the same vulnerable repository.
- ✗
Move backups to a larger NAS with more available storage capacity.
Why it's wrong here
A larger NAS with more storage capacity addresses space constraints, not security or resilience. The new NAS would still reside on the production network and be equally reachable and writable by the same ransomware, meaning larger capacity only gives the attacker more data to encrypt. Additional disk space does not introduce an air gap, immutability, or separate authentication domain—those are the controls that actually stop ransomware from tampering with backups. Without architectural isolation, greater capacity actually increases the potential damage if the NAS is compromised.
- ✓
Keep one backup copy offline or immutable and outside the production domain.
Why this is correct
An offline or immutable copy is the strongest practical protection against ransomware that can reach the network backup target. Separating that copy from the production domain also reduces the chance that compromised admin credentials can alter it. This improves resilience without requiring a full redesign, and it gives the organization a trusted recovery source even if online backups are encrypted or deleted.
- ✗
Run backups more frequently to the same NAS so newer files are captured sooner.
Why it's wrong here
Increasing backup frequency to the same NAS only shortens the recovery point objective (RPO); it does nothing to protect the backup repository itself. If ransomware has write access to the NAS—via a mounted share or stored credentials—it will simply encrypt both the live data and every new backup copy as they are created. More frequent backups actually may increase the attack surface because the NAS remains continuously reachable and writable by compromised hosts, so newer snapshots are just as vulnerable as older ones. The core problem is that the NAS is a network-accessible, writable target, not that the backup data is stale.
Go deeper
Related to this question
Learn chapter
Identity and Access Management
Key term
Ransomware
Ransomware is a type of malicious software that encrypts a victim's files or locks them out of their system, demanding payment, usually in cryptocurrency, to restore access.
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.