Security Operations →easyMultiple ChoiceObjective-mapped

SY0-701 Security Operations Practice Question

Exhibit

Backup Status Report
System: File Server FS-03
Nightly Backup Job: SUCCESS
Backup Sets Retained: 14
Last Successful Job: 02:00 today
Last Restore Test: 118 days ago
Note: No recent validation of file recovery has been recorded.

Based on the exhibit, what should the team do next to confirm the backups can actually be used during an outage?

⚠ Common exam trap

Many candidates assume a successful backup job (green status) guarantees recoverability, but the exam tests the distinction between backup completion and restore validation—CompTIA often tests this by making 'increase retention' or 'simplify backup type' seem like proactive steps, when only a test restore confirms usability.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Perform a test restore to a nonproduction location and verify the recovered files.

The only way to confirm that backups are usable during an outage is to perform a test restore to a nonproduction location and verify the recovered files. This validates the integrity of the backup data, the restore process, and that the files are complete and functional, which is a core principle of backup validation (often called a 'restore test' or 'disaster recovery drill'). Simply reviewing backup status reports or increasing retention does not prove that the data can be successfully restored.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Increase the retention period before making any restore attempts.
Why it's wrong here
Increasing the retention period does not validate the usability or integrity of the backup data. It simply stores more copies for a longer time, but if the backup itself is corrupt, incomplete, or missing critical files, time alone will not repair it. Restore testing is the only way to prove that the data can actually be recovered, and delaying that test merely postpones discovery of a broken backup.
✓
Perform a test restore to a nonproduction location and verify the recovered files.
Why this is correct
A test restore is the best way to validate that backups are usable during recovery. Successful backup jobs alone do not guarantee that data can be restored quickly, completely, or without corruption. Restoring to a nonproduction location confirms the files open correctly and helps the team measure recovery readiness before an actual incident.
✗
Delete older backup sets so the backup window is shorter.
Why it's wrong here
Deleting older backup sets shortens the backup window but simultaneously removes valid recovery points, increasing the risk of data loss if the most recent backup fails or is corrupted. This action also does nothing to verify that the remaining backups are restorable; it may even violate compliance or retention policies. Operational efficiency should never replace direct validation of the backup's recoverability.
✗
Convert the backups to full backups only so the status report is simpler.
Why it's wrong here
Converting to full backups only changes the backup methodology and may simplify reporting, but it does not test the ability to restore data. Full backups can still suffer from corruption, hardware failures, or human error, and the change may increase storage costs and backup duration. A simpler status report is irrelevant to confirming that the team can successfully recover files, which requires an actual test restore to a nonproduction environment.

Go deeper

SY0-701 Security Operations Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question