SY0-701 Security Operations Practice Question
An engineering firm backs up its file server every night to a NAS that is always mounted to the production domain. After a ransomware event, management asks for the most effective improvement to reduce the chance that backups are encrypted along with production data. What should be recommended?
⚠ Common exam trap
It's easy for candidates to think increasing backup frequency or keeping backups local improves security, but the core issue is that the backup must be isolated from the production domain to survive a ransomware attack that encrypts all reachable data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Keep an offline or immutable backup copy that is not continuously reachable from production
An offline or immutable backup copy that is not continuously reachable from the production domain prevents ransomware from encrypting it. Since the NAS is always mounted to the production domain, it is vulnerable to lateral movement and encryption by ransomware. An offline backup (e.g., tape or disconnected disk) or an immutable backup (e.g., using S3 Object Lock or a write-once file system) ensures that even if production data is compromised, the backup remains intact and recoverable.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Increase the backup frequency but leave the NAS always online
Why it's wrong here
Increasing backup frequency improves the recovery point objective but does not address the core vulnerability: an always-online NAS is directly reachable from compromised production systems. Ransomware can encrypt or delete current and previous backup files if it gains credentials or exploits a network share, thereby destroying the entire backup set. More frequent copies are useless if every copy is equally accessible to the attacker, so this measure only reduces data loss, not the risk of total backup compromise.
- ✓
Keep an offline or immutable backup copy that is not continuously reachable from production
Why this is correct
An offline (air-gapped) or immutable backup, such as WORM storage or S3 Object Lock, is not continuously reachable from the production network, so a ransomware intrusion that compromises the file server cannot easily alter or delete these copies. Even with domain admin privileges, an attacker cannot directly issue delete commands to a physically disconnected system or an object-locked repository. This ensures a known-good, unencrypted recovery point remains available, allowing the organization to restore operations without paying a ransom.
- ✗
Store backups in the same server room for faster restore times
Why it's wrong here
Storing backups in the same server room may reduce restore latency for local restores, but it places the backup media in the same physical and logical trust domain as the production servers. Ransomware, malicious insiders, and automated attacks can easily reach those systems, and a single fire, flood, or power failure could destroy both production and backup copies simultaneously. The core requirement is isolation and separation, not proximity; faster restores cannot compensate for the complete loss of backup data.
- ✗
Use only local snapshots on the file server because they are simpler to manage
Why it's wrong here
Local snapshots, such as VSS or LVM snapshots, are stored on the same server or storage array as the live files, making them vulnerable to deletion via administrative credentials or ransomware that calls privileged APIs. Attackers routinely delete shadow copies before encrypting data (e.g., using vssadmin delete shadows), so relying solely on snapshots leaves no recoverable copy after such an attack. While snapshots are convenient for rolling back accidental changes, they share the same attack surface as production data and are not a valid ransomware defense.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
Learn chapter
Identity and Access Management
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
Key term
Lateral movement
Lateral movement is the technique attackers use to move through a network from one compromised system to another, seeking sensitive data or higher privileges.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.