SK0-005 security-disaster-recovery Practice Question
A medium-sized e-commerce company operates three critical servers: a web front-end, a database server, and a file server. Currently, a full backup of all servers is performed every Sunday starting at 11:00 PM and completes in about 6 hours. Differential backups run each weekday at 11:00 PM, taking roughly 2 hours. On a Wednesday at 10:00 AM, a ransomware attack encrypts all data on all servers. The IT team’s incident response plan requires restoration with an RPO of 4 hours and an RTO of 8 hours. The latest clean backup is Tuesday’s differential, resulting in approximately 10 hours of data loss. Future attacks could occur at any time. Management is willing to spend up to $200 per month to improve the backup strategy but cannot afford new hardware or a dedicated hot site. The team needs a solution that reduces both RPO and RTO within budget while maintaining simplicity for a small IT staff of two. Which of the following backup strategies should be implemented to best meet these requirements?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement hourly incremental backups with daily full backups to a cloud backup service, costing $50/month.
B is correct. Hourly incremental backups with daily fulls to a cloud service gives a maximum data loss of about one hour (if failure right before an incremental), meeting the 4-hour RPO. Daily full backups ensure faster restoration since only the last full and up to a few incrementals need to be applied, likely achieving an 8-hour RTO. The $50/month cost is within budget. Option A (daily full to NAS) extends the backup window to 8 hours and may not meet RPO if an attack occurs between backups. Option C (more frequent differentials) will cause backup times to grow, potentially exceeding the window, and still may have a 4-hour RPO gap if scheduled every 4 hours but an attack occurs after the last. Option D is cost-prohibitive. Thus, B is feasible and effective.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Switch to daily full backups to a local NAS, which takes 8 hours.
Why it's wrong here
A 24-hour RPO (if attack occurs before next full) does not meet the 4-hour requirement, and an 8-hour restore will likely exceed the RTO, especially for large data sets.
- ✗
Adopt real-time replication to a hot site located offsite.
Why it's wrong here
This is well outside the $200/month budget and adds complexity that the two-person IT team cannot manage.
- ✗
Continue the current strategy but increase the frequency of differential backups to every 4 hours.
Why it's wrong here
Differential backups grow over time; running them every 4 hours would greatly extend the backup window, and there is still a potential 4-hour data loss gap if an attack occurs just before a backup.
- ✓
Implement hourly incremental backups with daily full backups to a cloud backup service, costing $50/month.
Why this is correct
This approach provides a practical balance of near-continuous data protection (RPO ≤ 1 hour), acceptable RTO, and fits the budget.
Go deeper
Related to this question
Learn chapter
BIOS/UEFI and Firmware Management
Key term
Business Continuity Planning
Business Continuity Planning is the process of creating a strategy to keep an organization's essential functions running during and after a major disruption.
Key term
Ransomware
Ransomware is a type of malicious software that encrypts a victim's files or locks them out of their system, demanding payment, usually in cryptocurrency, to restore access.
About these practice questions
Courseiva writes every SK0-005 question from scratch — 185 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SK0-005
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A system administrator is configuring a backup schedule for a critical database server that must be available 24/7. The company's recovery point objective (RPO) is 1 hour and recovery time objective (RTO) is 4 hours. The database files change frequently, but the operating system and application binaries rarely change. Which of the following backup strategies would BEST meet these requirements while minimizing storage and backup window impact?
hard- A.Full backup daily, differential backup every hour
- B.Full backup weekly, differential backup every hour
- ✓ C.Full backup daily, incremental backup every hour
- D.Full backup weekly, incremental backup every hour
Why C: Option D is correct because daily full backups provide a recent recovery base, and hourly incremental backups are small and fast, meeting the 1-hour RPO with minimal backup window. Restoration applies at most 24 incrementals to the latest full, which fits within the 4-hour RTO. Option A is wrong because weekly full backups with hourly incrementals may require restoring too many incrementals, risking the RTO. Option B is wrong because hourly differential backups grow in size throughout the day, increasing backup time and storage. Option C is wrong because weekly fulls with hourly differentials cause exponential growth in differential size over the week.
Variation 2. A database server hosts a critical application that requires a recovery point objective (RPO) of 4 hours. The company wants to minimize the impact on production performance during backups. Which backup strategy should be implemented?
easy- A.Continuous data protection (CDP) with synchronous replication.
- B.A weekly full backup with daily differential backups.
- ✓ C.A weekly full backup with hourly incremental backups.
- D.A nightly full backup.
Why C: Option C is correct because hourly incremental backups meet the 4-hour RPO while minimizing resource usage compared to more frequent full backups or continuous replication. Option A is wrong because differential backups grow in size and can still exceed the RPO window. Option B is wrong because nightly full backups would fail to meet the 4-hour RPO if a disaster occurs hours after the last backup. Option D is wrong because CDP with synchronous replication imposes high performance overhead and is unnecessary beyond the 4-hour RPO requirement.
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed July 2026 · checked against the official CompTIA exam blueprint
This SK0-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SK0-005 exam.