SY0-701 Security Operations Practice Question
After a ransomware event, management wants proof that last night's backups can actually support business operations before they declare recovery complete. What is the best action?
⚠ Common exam trap
Many exam-takers confuse backup management tasks (like retention or copying) with actual recovery validation, or think that security scanning proves backup usability, when only a functional test restore provides the required proof of operability.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Perform a test restore into an isolated environment and validate the files or application work correctly.
Performing a test restore into an isolated environment directly validates that the backup data is intact, the restore process works, and the restored files or applications function as expected. This provides management with the proof they need to confirm business operations can resume, which is the core requirement after a ransomware event.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Perform a test restore into an isolated environment and validate the files or application work correctly.
Why this is correct
A test restore is the only option that proves the backup can actually be recovered and used. By restoring into an isolated environment, the team avoids contaminating production while still confirming that data, permissions, and the application behave as expected. This also helps validate recovery objectives and exposes problems such as corrupted backups, missing dependencies, or failed restore procedures before a real outage occurs.
- ✗
Increase the backup retention period without testing the backups.
Why it's wrong here
Extending the backup retention period only changes how long backup sets remain in storage; it does not exercise the restore mechanism or verify that any given backup contains intact, usable data. Without a test restore, corrupted media, incomplete backup jobs, or missing application dependencies will remain undetected. This action is a policy adjustment, not a proof of recoverability.
- ✗
Copy the backup set to a new storage bucket and assume it is usable.
Why it's wrong here
Copying a backup set to another bucket verifies nothing about the data's integrity or the ability to reconstruct a working system; it is merely a storage operation. Even if the copy is byte-for-byte identical, the restore process, file permissions, and application configurations remain untested, and an incomplete copy could introduce latent corruption. The suspect backup could still be missing critical files or be encrypted in a way that prevents successful recovery.
- ✗
Run a vulnerability scan against the backup server.
Why it's wrong here
A vulnerability scan assesses the backup server's operating system and services for known security weaknesses, but it says nothing about whether a specific backup image can be restored successfully. It will not detect a failed backup job, a truncated database dump, or a corrupted application configuration inside the backup set. This action supports the security of the backup infrastructure, not the validation of recoverability, which is a separate and more operationally critical concern.
Go deeper
Related to this question
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.