SK0-005 security-disaster-recovery Practice Question
A medium-sized company uses a backup strategy that includes a full backup every Sunday at 2:00 AM and differential backups Monday through Saturday at 2:00 AM. The backups are written to a network-attached storage (NAS) device. On Thursday morning, the company experiences a ransomware attack that encrypts all data on the file server, including the NAS. The administrator needs to restore the file server with minimal data loss. The last successful full backup was from the previous Sunday, and differential backups were successful on Monday, Tuesday, and Wednesday. However, Thursday's differential was not completed because the attack occurred before the scheduled time. The administrator attempts to restore using the Sunday full backup and Thursday's differential, but the restore fails because the differential backup on the NAS is also encrypted. Which of the following is the best course of action?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Restore from the Sunday full backup and Wednesday's differential backup
The most recent clean backup set is Sunday's full plus Wednesday's differential, as both were taken before the ransomware attack. Restoring from these will recover data as of Wednesday's backup, minimizing data loss. Using only Wednesday's differential requires the full backup first. Paying the ransom is not recommended and may not work. Reinstalling the OS and restoring from cloud would not apply because cloud was not mentioned.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Pay the ransom to decrypt the differential backup
Why it's wrong here
Paying the ransom is not a recommended security practice and may not result in decryption.
- ✓
Restore from the Sunday full backup and Wednesday's differential backup
Why this is correct
This is the most recent complete and uncorrupted backup set, providing the best recovery point.
- ✗
Reinstall the operating system and restore files from cloud storage
Why it's wrong here
There is no indication that cloud storage is available, and this would not utilize existing backups.
- ✗
Restore using only Wednesday's differential backup
Why it's wrong here
Differential backups require the last full backup to be restored first; they are incremental from the full, not standalone.
Go deeper
Related to this question
Learn chapter
Troubleshooting Network and Connectivity Issues
Key term
NAS
NAS is a dedicated file-level storage device connected to a network, providing centralized data access to multiple clients via standard protocols like NFS or SMB.
Key term
Ransomware
Ransomware is a type of malicious software that encrypts a victim's files or locks them out of their system, demanding payment, usually in cryptocurrency, to restore access.
About these practice questions
This SK0-005 question is part of Courseiva's 185-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SK0-005
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A system administrator configures full backups on Sunday evenings and differential backups on weekdays. On Thursday morning, a disk failure occurs. Which of the following sets of backups is necessary to completely restore the server's data with the fewest number of backup files?
medium- A.Sunday full only
- B.Sunday full, Monday differential, Tuesday differential, Wednesday differential
- C.Sunday full and Thursday differential
- ✓ D.Sunday full and Wednesday differential
Why D: A differential backup includes all changes since the last full backup. Therefore, only the most recent differential and the last full backup are needed for a complete restore. Using Sunday's full and Wednesday's differential requires just two files, whereas incremental backups would require the full plus every incremental since. Option A (full plus all four differentials) is unnecessary. Option C references a Thursday backup that hasn't occurred yet. Option D ignores all changes since Sunday.
Variation 2. A server hosts a database that requires nightly backups. The backup strategy uses a full backup every Sunday and differential backups on other days. On Wednesday, the server fails. Which backup sets are required to restore to the most recent state?
medium- A.Last full backup and all differential backups since Sunday
- B.Last full backup only
- ✓ C.Last full backup and the latest differential backup
- D.Last full backup and all incremental backups since Sunday
Why C: A differential backup contains all changes since the last full backup. Therefore, only the last full backup and the latest differential are needed for a restore. Incremental backups would require all incrementals since the last full, but the scenario uses differential backups.
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed July 2026 · checked against the official CompTIA exam blueprint
This SK0-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SK0-005 exam.