SY0-701 Security Operations Practice Question
Exhibit
Backup status for the billing application Current design: - Nightly full backup at 01:00 - Backup repository: NAS-BACKUP01 - NAS-BACKUP01 is joined to the same Active Directory domain as production servers - Backup share is mounted over SMB from the production network - Last restore test: 5 months ago, failed due to permissions error Business targets: - RTO: 4 hours - RPO: 30 minutes
Based on the exhibit, which change best helps the company meet its recovery objectives after a ransomware event?
⚠ Common exam trap
It's easy for candidates to assume longer retention or more frequent backups alone improve recovery, but they overlook the need for isolation and immutability to protect against ransomware's ability to target accessible backup data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Move backups to an immutable, offline or logically isolated repository and test restores regularly.
Ransomware often encrypts or deletes accessible backups. An immutable, offline, or logically isolated repository prevents attackers from modifying or deleting backup data, ensuring a clean recovery point. Regularly testing restores validates that the backups are functional and meet recovery objectives (RTO/RPO). This aligns with the 3-2-1 backup rule and NIST SP 800-184 guidance for ransomware recovery.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Increase the retention period on the existing NAS backups to one year.
Why it's wrong here
Extending retention on a domain-joined NAS only lengthens the data's exposure window; if ransomware compromises the repository, the retained backups are just as encryptable or deletable as the active data. Retention policies are time-based, not security controls, so they do nothing to block an attacker who has already gained access to the SMB share or the underlying storage. In fact, a longer retention period increases the attack surface, because more encrypted or damaged backup files will persist and be unknowingly used for recovery, potentially reintroducing malicious payloads.
- ✓
Move backups to an immutable, offline or logically isolated repository and test restores regularly.
Why this is correct
An isolated, immutable backup target reduces the chance that ransomware can encrypt or delete backups. Regular restore testing confirms that the company can actually recover within the stated RTO and RPO. Because the current repository is domain-joined and reachable over SMB, it is too exposed. Isolation and tested recovery provide the strongest practical resilience improvement.
- ✗
Store the backup administrator password in a shared team spreadsheet so more staff can restore data quickly.
Why it's wrong here
Sharing the backup administrator password in a shared spreadsheet violates the principle of least privilege and removes non-repudiation, making it impossible to trace who restored or altered backups. It also expands the attack surface: any phishing victim who can access the spreadsheet gains valid credentials to the backup system, which is exactly what ransomware operators exploit. A password manager with role-based access controls and MFA would be a minor improvement, but it still does not address the core issue that the backup repository itself is reachable and mutable from the production network.
- ✗
Replace the nightly full backup with a longer full backup window to capture more data each day.
Why it's wrong here
Lengthening the nightly full backup window may actually worsen your recovery point objective (RPO) because it pushes the backup start time later, meaning the last consistent recovery point is further away from the moment of failure. It also increases the duration that backup processes are active, giving an attacker more time to interfere with them, and it consumes more bandwidth and storage without providing any additional isolation or integrity checking. The correct fix for an RPO gap is to reduce backup frequency with incremental backups or continuous data protection, not to make the existing full backup run longer.
Go deeper
Related to this question
Learn chapter
Windows Event Log Analysis
Key term
Ransomware
Ransomware is a type of malicious software that encrypts a victim's files or locks them out of their system, demanding payment, usually in cryptocurrency, to restore access.
Key term
RTO
Recovery Time Objective is the maximum acceptable time to restore a system or data after a disaster, defining how quickly normal operations must resume.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.