SY0-701 Security Operations Practice Question
After a ransomware incident, management learns the attacker's stolen domain admin credentials were used to delete recent online backups from the same backup network. Which backup strategy would have most reduced the chance of permanent backup loss?
⚠ Common exam trap
Candidates often assume longer retention or same-server backups are sufficient, but the key is that immutability and isolation (air gap) are required to prevent an attacker with elevated credentials from deleting backups, which is a core concept tested in SY0-701 Domain 3.0 (Security Operations).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Immutable backups stored in a separate repository or offline location.
Immutable backups stored in a separate repository or offline location prevent deletion or modification by an attacker, even with domain admin credentials. This is because immutability enforces a write-once-read-many (WORM) policy, often implemented via object lock (e.g., S3 Object Lock) or a physical air gap, ensuring that backups cannot be altered or deleted before their retention period expires. In this scenario, the attacker's ability to delete online backups from the same network is mitigated because the immutable repository is isolated and resistant to credential-based tampering.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Nightly incremental backups stored on the same file server as production data.
Why it's wrong here
Storing nightly incrementals on the same file server as production data creates a single compromise boundary: any attacker who gains privileged access to that server can encrypt or delete both the live data and the entire backup chain. Because incremental backups depend on the last full backup plus each successive differential, a maliciously deleted or encrypted incremental renders all subsequent recovery points unusable. This approach also violates the 3-2-1 rule, which requires copies on separate media and at least one offsite location. A ransomware payload that runs as admin on that host will simply traverse into the backup share and destroy the recovery path.
- ✓
Immutable backups stored in a separate repository or offline location.
Why this is correct
Immutable backups in a separate repository or offline location are the correct defense because they make recovery data both tamper-proof and network-isolated. Object locking (e.g., S3 Object Lock with WORM mode) or filesystem-level immutable flags (such as chattr +i on Linux) prevent deletion or modification even by accounts with administrative privileges, as the data is retained until an explicitly set retention period expires. Offline media like rotated tape or an air-gapped storage array ensures that the ransomware cannot reach the repository via the production network or lateral movement. This design adheres to the 3-2-1 rule and satisfies CISA/NIST guidance for ransomware-resilient backups.
- ✗
Hypervisor snapshots only, because they are always safer than backups.
Why it's wrong here
Hypervisor snapshots are not a safer alternative to backups because they are typically stored as delta files on the same shared storage as the production virtual disks, and they inherit all of that storage's vulnerability to encryption and deletion. If an attacker compromises the hypervisor or the storage system, they can easily remove the snapshot files or even use the hypervisor's API to wipe the entire snapshot chain. Snapshots also are not a valid backup for long-term retention because they degrade I/O performance and are designed for short-term rollback, not disaster recovery. Even a 'clean' snapshot may retain the ransomware payload or its residues, so it does not provide a trustworthy recovery point.
- ✗
Longer retention on the same backup share to keep more versions available.
Why it's wrong here
Simply lengthening retention on the same backup share gives the attacker a larger target to encrypt or delete—the retention period does not protect the data from a credential compromise that allows access to that share. Since the backup share resides inside the production trust boundary, the same admin credentials that the ransomware obtains can also be used to remove all versions at once, making the extra history worthless. It also increases storage costs without adding any isolation or immutability. Longer retention is only useful when combined with separate, immutable, or offline storage.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
Learn chapter
Identity and Access Management
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
Worm
A worm is a type of malicious software that can copy itself and spread to other computers over a network, often without any human action.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.