SY0-701 Security Operations Practice Question
A company wants to make sure it can recover quickly after ransomware, even if the production network is unavailable. Which backup approach is the best choice?
⚠ Common exam trap
Watch out — candidates often think 'offline' means simply not connected to the internet, but the key is physical or logical disconnection from the production network to prevent ransomware from reaching the backup during an active attack.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Keep an offline copy of backups that is disconnected from production systems.
An offline (air-gapped) backup, such as a tape stored in a safe or a disconnected external drive, ensures that ransomware cannot encrypt or delete the backup data. This approach guarantees recoverability even when the production network is completely compromised or unavailable, aligning with the 3-2-1 backup rule (three copies, two media types, one offsite/offline).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store backups only on the same file server so they are easy to access.
Why it's wrong here
Storing backups exclusively on the same file server places them within the same trust boundary as production data. Ransomware that gains access to the server will typically enumerate and encrypt every mounted volume, including the backup folder, and may also delete Volume Shadow Copies. Since the backup is immediately accessible to the compromised operating system, it offers no isolation and fails to provide a recovery point outside the attack surface.
- ✓
Keep an offline copy of backups that is disconnected from production systems.
Why this is correct
An offline backup, such as a disk disconnected from the network or stored in an air-gapped environment, is not addressable by production systems or the ransomware running on them. Because the attacker cannot reach the media during the encryption or deletion phase, the copy remains intact and provides a clean, authoritative restore source. This directly supports the 3-2-1 backup rule: three copies, two different media, one offsite and offline, ensuring recoverability even when every online copy is compromised.
- ✗
Use a single monthly backup and never test restores to save time.
Why it's wrong here
A single monthly backup creates an unacceptably large recovery point objective (RPO), meaning a successful restore can lose up to a month of changes, which is catastrophic for most organizations. Additionally, never testing restores means logical corruption, incomplete writes, or malware-embedded backups go undetected until the moment of crisis, when a failed restore leaves the business permanently down. Reliable ransomware recovery requires frequent, tested restores to verify both the integrity and the time-to-recovery of the backup chain.
- ✗
Save backups in the same cloud account using the same admin credentials.
Why it's wrong here
Storing backups in the same cloud account with the same admin credentials ties recovery to the exact identity that an attacker may compromise. If the administrator account is phished, exposed, or reused, a ransomware operator can log into the cloud console and delete the backup buckets or object versions, defeating the purpose of offsite storage. This design also lacks identity separation and fails to enforce least privilege, whereas a hardened backup strategy uses distinct accounts, multi-factor authentication, and immutable storage or versioning with separate retention policies.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.