SY0-701 Security Operations Practice Question
Exhibit
System: ERP database cluster Business requirements: - RTO = 2 hours - RPO = 30 minutes Current recovery design: - Nightly full backup at 23:00 to onsite NAS - Differential backup at 12:00 - Weekly copy replicated to cloud on Sundays Restore test results: - Cold rebuild of VM + database restore: 5 hours 40 minutes - Data gap since last backup: 2 hours 18 minutes - NAS is online and joined to the same domain as production servers
Based on the exhibit, which change best improves both recovery time and recovery point for the ERP database?
A mid-sized company has a two-hour RTO and a 30-minute RPO, but its current backup design cannot meet either objective during restore testing.
⚠ Common exam trap
Many exam-takers confuse backup frequency (e.g., more full backups) with recovery point improvement, failing to recognize that only transaction log backups or incremental changes can reduce RPO below the full backup interval, and that pre-staging is required to meet aggressive RTOs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement frequent transaction log backups and a pre-staged standby or automated recovery image.
Implementing frequent transaction log backups (e.g., every 5–10 minutes) allows point-in-time recovery, reducing the recovery point objective (RPO) to minutes. A pre-staged standby or automated recovery image reduces recovery time objective (RTO) by eliminating the need to restore from scratch, enabling near-instant failover. This directly addresses the company's inability to meet its 30-minute RPO and 2-hour RTO during restore testing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add a second nightly full backup at 23:30 to the same NAS device.
Why it's wrong here
Adding another nightly full backup to the same NAS device at 23:30 does not improve RPO because both copies represent the same 24-hour interval, leaving up to a full day of potential data loss. It also does not improve RTO, since restoring from either copy requires the same lengthy full backup transfer from the same storage. The single-device location introduces a shared failure domain, so a hardware failure or ransomware infection targeting the NAS could destroy both backups simultaneously.
- ✗
Move the NAS to a different VLAN but keep the backup schedule unchanged.
Why it's wrong here
Moving the NAS to a different VLAN improves network segmentation and may reduce the blast radius of an attack, but it leaves the backup cadence and restoration methodology untouched. The restore process still requires transferring the entire nightly full backup, so RTO remains slow, and the RPO still equals up to 24 hours of data loss from the last full backup. Without changes to backup frequency or recovery staging, the VLAN move is a security control, not a recovery improvement.
- ✓
Implement frequent transaction log backups and a pre-staged standby or automated recovery image.
Why this is correct
Transaction log backups reduce the amount of data lost between full backups, improving the RPO. A pre-staged standby or automated recovery image shortens rebuild time, improving the RTO. Together, these changes directly address both recovery objectives instead of simply storing the same backups more safely or for longer. The test results show that the current restore approach is far too slow and too coarse.
- ✗
Increase backup retention from one month to one year.
Why it's wrong here
Extending backup retention from one month to one year preserves historical copies for compliance, audit, or point-in-time rollback to an older state, but it does not alter the backup schedule or restore procedure. The RPO is still bounded by the nightly full backup—meaning up to 24 hours of lost transactions—and the RTO is still the time needed to fully restore from a large backup image. Longer retention may even increase storage cost and maintenance overhead, while the test results show the core problem is recovery speed and data freshness, not the depth of history.
Go deeper
Related to this question
Learn chapter
Container Hardening Best Practices
Key term
Recovery point objective
Recovery point objective (RPO) is the maximum acceptable amount of data loss measured in time, determining how frequently backups must be taken.
Key term
RPO
Recovery Point Objective (RPO) is the maximum acceptable amount of data loss measured in time, defining how recent data must be to resume operations after a disruption.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Based on the exhibit, which change best moves the ERP recovery design toward meeting both recovery targets?
hard- A.Increase the full backup frequency to every night and keep the same recovery process.
- ✓ B.Add a warm standby database with 15-minute log shipping and scheduled failover tests.
- C.Move backup media to the same server to reduce transfer time.
- D.Eliminate differential backups and rely only on weekly full backups.
Why B: Adding a warm standby database with 15-minute log shipping significantly reduces the recovery point objective (RPO) to near-zero and, combined with scheduled failover tests, ensures the recovery time objective (RTO) is met. This directly addresses the gap between the current backup-only approach and the required recovery targets, as log shipping provides near-continuous data protection and failover testing validates the recovery process.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.