SY0-701 Security Architecture Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Store all backups on a shared file server so administrators can restore them quickly.

  Why it's wrong here

  Storing all backups on a shared file server exposes them to the same network security domain as production systems. Ransomware that gains domain or share-level access can encrypt or delete the backup files, and an insider with write permissions could silently modify or purge historical copies. Although restores are fast, this design sacrifices confidentiality, integrity, and availability of the recovery data.

• ✓

  Use encrypted, immutable backups with an offline or offsite copy and defined retention periods.

  Why this is correct

  Encrypted, immutable backups prevent unauthorized reads via encryption and unauthorized writes via write-once-read-many (WORM) or object lock controls. Keeping an offline or offsite copy provides an air-gapped or geographically separate recovery source that survives ransomware propagation and physical disasters. Defining retention periods ensures you keep enough recovery points for your recovery point objective (RPO) while avoiding indefinite storage growth, and it also supports legal or compliance needs.

• ✗

  Keep only the most recent snapshot to reduce storage cost and simplify recovery.

  Why it's wrong here

  Keeping only the most recent snapshot means you have a single recovery point; if that snapshot is encrypted, corrupted, or inadvertently deleted, you have nothing to restore from before the incident. Snapshots stored on the same volume (common with array-based or host-based snapshots) are also susceptible to the same ransomware that hits the primary data. A mature backup strategy requires multiple versions or restore points to allow rollback to a clean state.

• ✗

  Rely on RAID mirroring because it automatically creates a secure archival copy.

  Why it's wrong here

  RAID mirroring (RAID 1) duplicates the same logical data to two disks in near real time, so it protects against a single physical disk failure, but it provides no protection against logical corruption, ransomware encryption, or accidental deletion. Any change to the source volume, including malicious encryption, is immediately mirrored to the 'copy.' It also does not create an offline or offsite archival copy, so it fails the core requirements of a backup system.