Question 71 of 144
SK0-005 security-disaster-recovery Practice Question
A medium-sized e-commerce company operates three critical servers: a web front-end, a database server, and a file server. Currently, a full backup of all servers is performed every Sunday starting at 11:00 PM and completes in about 6 hours. Differential backups run each weekday at 11:00 PM, taking roughly 2 hours. On a Wednesday at 10:00 AM, a ransomware attack encrypts all data on all servers. The IT team’s incident response plan requires restoration with an RPO of 4 hours and an RTO of 8 hours. The latest clean backup is Tuesday’s differential, resulting in approximately 10 hours of data loss. Future attacks could occur at any time. Management is willing to spend up to $200 per month to improve the backup strategy but cannot afford new hardware or a dedicated hot site. The team needs a solution that reduces both RPO and RTO within budget while maintaining simplicity for a small IT staff of two. Which of the following backup strategies should be implemented to best meet these requirements?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement hourly incremental backups with daily full backups to a cloud backup service, costing $50/month.
B is correct. Hourly incremental backups with daily fulls to a cloud service gives a maximum data loss of about one hour (if failure right before an incremental), meeting the 4-hour RPO. Daily full backups ensure faster restoration since only the last full and up to a few incrementals need to be applied, likely achieving an 8-hour RTO. The $50/month cost is within budget. Option A (daily full to NAS) extends the backup window to 8 hours and may not meet RPO if an attack occurs between backups. Option C (more frequent differentials) will cause backup times to grow, potentially exceeding the window, and still may have a 4-hour RPO gap if scheduled every 4 hours but an attack occurs after the last. Option D is cost-prohibitive. Thus, B is feasible and effective.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Switch to daily full backups to a local NAS, which takes 8 hours.
Why it's wrong here
A 24-hour RPO (if attack occurs before next full) does not meet the 4-hour requirement, and an 8-hour restore will likely exceed the RTO, especially for large data sets.
- ✗
Adopt real-time replication to a hot site located offsite.
Why it's wrong here
This is well outside the $200/month budget and adds complexity that the two-person IT team cannot manage.
- ✗
Continue the current strategy but increase the frequency of differential backups to every 4 hours.
Why it's wrong here
Differential backups grow over time; running them every 4 hours would greatly extend the backup window, and there is still a potential 4-hour data loss gap if an attack occurs just before a backup.
- ✓
Implement hourly incremental backups with daily full backups to a cloud backup service, costing $50/month.
Why this is correct
This approach provides a practical balance of near-continuous data protection (RPO ≤ 1 hour), acceptable RTO, and fits the budget.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jul 26, 2026
This SK0-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SK0-005 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.