SY0-701 Security Operations Practice Question
Exhibit
Current backup design: - Production file server backs up nightly at 23:00 to NAS-Backup over SMB. - NAS-Backup is mounted read/write to the file server 24x7. - Weekly copy job replicates NAS contents to cloud object storage. - Backup credentials are shared with the server admin group. - Last restore test: 14 months ago. Incident summary: - Ransomware encrypted production files and then encrypted the NAS share using the same credentials.
Based on the exhibit, which change best improves recovery resilience against a repeat ransomware incident?
⚠ Common exam trap
A common mix-up: candidates assume faster backups (Option B) or more capacity (Option A) improve resilience, but they overlook the fundamental requirement that backups must be protected from modification by the attacker, which only immutability or an air gap provides.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use an immutable or offline backup copy that production credentials cannot modify.
Ransomware often encrypts or deletes accessible backups. An immutable or offline backup copy (e.g., using S3 Object Lock, Write Once Read Many (WORM) storage, or air-gapped tape) ensures that even if production credentials are compromised, the backup data cannot be modified or deleted by the attacker. This directly preserves a clean recovery point after a ransomware incident.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Keep the current design and add more NAS storage capacity.
Why it's wrong here
Adding NAS storage capacity only increases the amount of data that can be stored on the same online, writable backup share. The backup target remains reachable with the same production credentials, so an attacker who compromises the file server can still enumerate, encrypt, or delete both the original data and the backup copy. Capacity planning does not address the fundamental vulnerability: the backup is not protected from the active threat actor. In ransomware recovery, the priority is ensuring a clean, recoverable copy exists, not simply having more room for potentially encrypted data.
- ✗
Move the NAS to the same subnet as the file server for faster backups.
Why it's wrong here
Placing the NAS on the same subnet as the file server may reduce backup transfer latency, but it eliminates network isolation between production and backup environments. An attacker who gains a foothold on the file server can use lateral movement techniques to reach the NAS directly over the trusted network segment, often reusing cached credentials or exploiting trust relationships. Effective backup protection relies on network segmentation, access controls, and sometimes an air gap—not on minimizing the distance between the data and its backup. This change actually increases the blast radius and makes the backup more vulnerable to compromise.
- ✓
Use an immutable or offline backup copy that production credentials cannot modify.
Why this is correct
The incident showed that the attacker could encrypt both production and the backup share because the backup target stayed online and writable. An immutable or offline copy breaks that dependency and prevents the same credentials from destroying recovery data. In ransomware recovery, backup survivability matters more than convenience, so this change gives the strongest resilience improvement.
- ✗
Shorten the backup retention period to reduce storage use.
Why it's wrong here
Shortening the backup retention period reduces storage consumption but also shrinks the available recovery window. Ransomware attacks are not always detected immediately; attackers may dwell in the environment for weeks before triggering encryption, potentially corrupting or encrypting backups taken during that window. If retention is too short, you may be forced to recover to a point in time after the initial compromise, meaning the restored data is already infected or unusable. Additionally, this change does nothing to protect the remaining backups from being encrypted or deleted by the same compromised production credentials.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
Learn chapter
Incident Response Process
Key term
Ransomware
Ransomware is a type of malicious software that encrypts a victim's files or locks them out of their system, demanding payment, usually in cryptocurrency, to restore access.
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.