SY0-701 Security Architecture Practice Question
A company is concerned about ransomware and insider tampering with backups. It wants daily restore points, monthly archives, and protection if a backup drive is stolen from the storage room. Which backup design is the best answer?
⚠ Common exam trap
A common mix-up: candidates confuse high-availability features like RAID with backup security, or assume that network-accessible storage is sufficient, failing to recognize that immutability and offline/offsite copies are essential for ransomware and theft protection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use encrypted, immutable backups with an offline or offsite copy and defined retention periods.
Encrypted, immutable backups prevent ransomware from encrypting or modifying backup data, and an offline or offsite copy protects against physical theft of the backup drive. Defined retention periods satisfy the daily restore points and monthly archives requirement, while immutability ensures backup integrity even if an attacker gains access to the backup system.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store all backups on a shared file server so administrators can restore them quickly.
Why it's wrong here
Storing all backups on a shared file server exposes them to the same network security domain as production systems. Ransomware that gains domain or share-level access can encrypt or delete the backup files, and an insider with write permissions could silently modify or purge historical copies. Although restores are fast, this design sacrifices confidentiality, integrity, and availability of the recovery data.
- ✓
Use encrypted, immutable backups with an offline or offsite copy and defined retention periods.
Why this is correct
Encrypted, immutable backups prevent unauthorized reads via encryption and unauthorized writes via write-once-read-many (WORM) or object lock controls. Keeping an offline or offsite copy provides an air-gapped or geographically separate recovery source that survives ransomware propagation and physical disasters. Defining retention periods ensures you keep enough recovery points for your recovery point objective (RPO) while avoiding indefinite storage growth, and it also supports legal or compliance needs.
- ✗
Keep only the most recent snapshot to reduce storage cost and simplify recovery.
Why it's wrong here
Keeping only the most recent snapshot means you have a single recovery point; if that snapshot is encrypted, corrupted, or inadvertently deleted, you have nothing to restore from before the incident. Snapshots stored on the same volume (common with array-based or host-based snapshots) are also susceptible to the same ransomware that hits the primary data. A mature backup strategy requires multiple versions or restore points to allow rollback to a clean state.
- ✗
Rely on RAID mirroring because it automatically creates a secure archival copy.
Why it's wrong here
RAID mirroring (RAID 1) duplicates the same logical data to two disks in near real time, so it protects against a single physical disk failure, but it provides no protection against logical corruption, ransomware encryption, or accidental deletion. Any change to the source volume, including malicious encryption, is immediately mirrored to the 'copy.' It also does not create an offline or offsite archival copy, so it fails the core requirements of a backup system.
Go deeper
Related to this question
Learn chapter
Secure Network Design Principles
Key term
Ransomware
Ransomware is a type of malicious software that encrypts a victim's files or locks them out of their system, demanding payment, usually in cryptocurrency, to restore access.
Key term
Integrity
Integrity is the assurance that data has not been altered or tampered with in an unauthorized way, preserving its accuracy and consistency from source to destination.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.