After a ransomware incident, management learns the attacker's stolen domain admin credentials were used to delete recent online backups from the same backup network. Which backup strategy would have most reduced the chance of permanent backup loss?

Nightly incremental backups stored on the same file server as production data.

This keeps backups too close to production and gives an attacker with privileged access a single target to destroy.

Hypervisor snapshots only, because they are always safer than backups.

Snapshots are useful for short-term recovery but are not a complete backup strategy and can still be vulnerable.

Longer retention on the same backup share to keep more versions available.

More versions do not help if the attacker can reach and delete the entire backup repository with the same credentials.

What does this SY0-701 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Immutable backups stored in a separate repository or offline location. — Immutable or offline backups are the strongest protection in this scenario because they limit an attacker’s ability to delete or modify recovery data even if administrative credentials are stolen. Storing backups in a separate trust boundary or offline location creates a major barrier to destructive actions. This is a core resilience control when ransomware targets both production systems and online backup infrastructure. Why others are wrong: Storing backups beside production data increases exposure to the same compromise. Hypervisor snapshots are useful, but they are not enough by themselves and often depend on the same infrastructure. Extending retention on a vulnerable repository does not protect the backups if an attacker can simply delete or corrupt them all.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.