Question 112 of 1,013
SY0-701 Security Operations Practice Question
An ERP database is backed up nightly to a NAS that remains online and is managed with the same admin group as production servers. After a ransomware incident, management wants the most effective change to improve recovery assurance without redesigning the whole environment. What should be implemented?
⚠ Common exam trap
Watch out — candidates often assume more copies or more storage (options A and B) improve recovery assurance, but they fail to recognize that all copies on the same online, writable NAS are equally vulnerable to ransomware encryption or deletion, making isolation and immutability the key differentiators.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use an offline or immutable backup copy and perform regular restore tests.
An offline or immutable backup copy ensures that ransomware cannot encrypt or delete the backup data, and regular restore tests verify that the backups are actually recoverable. This directly addresses the core requirement of improving recovery assurance without redesigning the environment, as it protects the backup from the same attack vector that compromised the production servers and the NAS managed by the same admin group.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Increase the NAS capacity so more backup jobs can be stored.
Why it's wrong here
Expanding NAS capacity only extends the retention window, letting more nightly jobs accumulate on the same always-online storage system. It provides no isolation, immutability, or access control change, so ransomware that compromises the NAS or the backup account can still encrypt or delete every stored copy. Storage growth also does nothing to verify that any backup can actually be restored, so recovery confidence remains unchanged.
- ✗
Add another full backup each night to create more copies on the same NAS.
Why it's wrong here
Adding a second nightly full backup onto the same NAS creates redundant copies but leaves them in the same trust domain and failure domain as the original. A single ransomware event that encrypts the share, a corrupted volume, or a compromised backup credential will destroy both copies simultaneously, so the blast radius is unchanged. It also remains unverified because no restore testing is performed, meaning the organization cannot prove the data is recoverable.
- ✓
Use an offline or immutable backup copy and perform regular restore tests.
Why this is correct
An offline or immutable backup reduces the chance that ransomware can encrypt or delete recovery data, and restore testing proves that the backups actually work. This combination improves resilience more effectively than simply storing more data on the same always-online system.
- ✗
Compress the backup files to reduce network usage during the nightly job.
Why it's wrong here
Compressing the backup stream reduces bandwidth consumption and storage footprint, which is purely an efficiency optimization for the nightly job. It does not alter the backup's exposure on the network, add immutability, or restrict who can access the NAS, so ransomware can still encrypt the compressed files just as easily as uncompressed ones. Because compression also lacks any integrity or restore verification, it provides no assurance that the compressed data is usable after an incident.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.