Courseiva

CCNA security-disaster-recovery Questions

44 questions · security-disaster-recovery · All types, answers revealed

1
MCQhard

An organization uses a cloud-based backup solution with immutable storage to protect against ransomware. However, after a recent attack, an attacker with stolen administrator credentials was able to delete the backup data. Which of the following BEST explains why the backups were deleted?

A.The backup solution did not support versioning.
B.The immutable storage policy was not configured correctly or had a retention lock that was not enabled.
C.The attacker used ransomware to encrypt the backup data at the source before it was sent.
D.The backup data was stored in a different geographic region than production.
AnswerB

Without a properly configured retention lock, even immutable storage may allow administrative deletions, defeating the purpose.

Why this answer

Option A is correct because true immutable storage prevents any deletion or modification, even by administrators, for a specified retention period. The fact that an admin could delete it indicates the immutability feature was misconfigured or not properly locked. Option B describes encryption at the source, but that would not allow deletion of existing backups.

Option C is irrelevant to deletion. Option D: versioning helps but does not prevent deletion if immutability is not configured.

2
MCQhard

A server administrator is restoring a file server from a full backup taken 7 days ago and incremental backups taken daily. The restoration fails with an error about missing catalog files. What is the most likely cause?

A.The hard drive on the file server has failed
B.The backup software is not compatible with the current OS version
C.The full backup media is corrupted
D.The incremental backup chain is broken
AnswerD

A broken chain (e.g., a missing incremental) prevents the restore from completing, often resulting in a catalog error.

Why this answer

Restoring from incremental backups requires a complete chain from the last full backup. If any incremental backup in the chain is missing or corrupted, the restore will fail. Corrupted full backup media would cause a different error.

OS compatibility issues would likely appear earlier. Hard drive failure would be a hardware error.

3
MCQhard

Refer to the exhibit. A disaster recovery test reveals the following timeline for a critical application. The business requires an RTO of 2 hours. Which of the following actions would MOST effectively reduce the RTO to meet the requirement?

A.Implement database replication to eliminate the database restore time.
B.Add more network bandwidth to speed up VM provisioning.
C.Use a warm site with pre-configured storage.
D.Automate application validation to reduce that phase by half.
AnswerA

Database replication provides a near-zero restore time, directly reducing the largest RTO component and achieving the 2-hour target.

Why this answer

Option A is correct because the database restore takes 120 minutes—the largest portion of the RTO. Replication would make the database continuously available, reducing that time to near zero and bringing total RTO to about 120 minutes (provisioning + validation) which meets the 2-hour target. Option B could reduce VM provisioning time but not address the database restore.

Option C reduces validation by 30 minutes, not enough. Option D does not significantly impact VM provisioning time, which is already only 60 minutes.

4
MCQmedium

An organization requires a disaster recovery site that can be operational within 24 hours after a disaster declaration, with critical data replicated on a regular basis, but not necessarily real-time. Which type of site should they implement?

A.Warm site
B.Alternate processing site
C.Cold site
D.Hot site
AnswerA

A warm site is partially equipped and can be made operational in about 24 hours.

Why this answer

Option A is correct because a warm site provides pre-installed hardware and network infrastructure, along with data backups that can be loaded and activated within a day. Hot sites offer immediate failover but are more expensive and not necessary here. Cold sites are empty space and take weeks.

An alternate processing site is a vague term.

5
MCQhard

An organization stores backup tapes at an offsite facility. The tapes contain sensitive customer data. A security audit revealed that tapes were stolen from the facility. Which combination of measures would have MOST effectively prevented unauthorized data access?

A.Encrypt all backup data with strong encryption and restrict decryption keys to authorized personnel.
B.Password-protect the tapes and keep them in a locked safe.
C.Store tapes in a fireproof safe and limit access to key personnel.
D.Use a bonded courier service for transportation.
AnswerA

Encryption is the only measure that directly protects data confidentiality even if physical media is stolen, as decryption requires the keys.

Why this answer

Option D is correct because encrypting the backup data and restricting decryption keys ensures that even if the tapes are physically stolen, the data remains unintelligible without the keys. Option A (password protection) can often be bypassed and does not secure the data itself. Option B only secures transport, not storage.

Option C provides physical security but would not deter a determined thief and does not protect the data if the safe is compromised.

6
MCQeasy

Refer to the exhibit. A backup administrator scheduled a nightly backup to a network share. The backup job fails with the error shown in the log. What is the most likely cause?

A.The backup destination disk is full
B.The network share is offline
C.The service account lacks write permissions to the share
D.The backup software is not installed
AnswerC

“Access denied” clearly indicates a permissions problem, and the backup account does not have the necessary rights.

Why this answer

Option C is correct because the “Access denied” message indicates a permissions issue, likely that the service account running the backup lacks write access to the share. The share being offline would likely show “network path not found,” a full disk would show “insufficient space,” and the software not installed would prevent the job from running at all.

7
PBQeasy

A small accounting firm has a single server that hosts their client database and financial applications. The server is backed up nightly using a full backup to an external USB hard drive, which is stored on a shelf next to the server. Last month, a fire broke out in the office, completely destroying the server and the backup drive. The company lost all data since their last offsite backup, which was six months old because they occasionally took a copy home. The business owner wants to prevent such a catastrophic data loss in the future but is concerned about cost and complexity. They have a limited IT budget and no dedicated IT staff. The firm operates 9-5 Monday to Friday, and can tolerate up to 24 hours of downtime and up to one day of data loss. After the fire, they had to rebuild their client records from paper files, which took weeks. The owner realizes the importance of an offsite backup routine but cannot afford an expensive cloud service or a second server. The firm's internet connection is a basic DSL line with limited upload bandwidth, making large cloud backups slow. The server has a single internal drive with enough free space to store additional copies. Which of the following backup strategies would best meet the firm’s recovery objectives while minimizing cost and complexity?

A.Buy a second external drive, alternate them, and keep one offsite at the owner’s house, rotating weekly.
B.Continue nightly full backups to an external drive, but have an employee take the drive home every evening.
C.Purchase a network-attached storage device and configure it to receive daily backups; place it in a different room in the building.
D.Subscribe to a cloud backup service and perform daily incremental backups over the internet.
AnswerB

Why this answer

Option B is correct because it provides a daily offsite backup, limiting data loss to at most 24 hours, which meets the RPO. It requires minimal additional cost (just the external drive) and no complex technology, fitting the firm's budget and lack of IT staff. Option A (cloud backup) would exceed the slow internet connection's capability and likely incur ongoing subscription costs, making it less suitable.

Option C (NAS in another room) does not protect against a site-wide disaster like fire, so it fails to provide offsite redundancy. Option D (weekly rotation) would result in an offsite copy that is up to a week old, violating the one-day RPO.

8
MCQmedium

A server administrator is responsible for protecting sensitive data. The backup process copies files to a network share daily. Which of the following should the administrator do to BEST ensure the confidentiality of the backup data both during transfer and at rest?

A.Configure the network share with SMB encryption only.
B.Use a dedicated NIC for backup traffic on an isolated VLAN.
C.Place the backup server in a physically locked cage with restricted access.
D.Encrypt the backup files before transfer using a tool like GPG, and store them encrypted.
AnswerD

Pre-transfer encryption protects data confidentiality both in transit and at rest on the backup media.

Why this answer

Encrypting the backup files before transfer (Option B) ensures data confidentiality during transit and while stored on the backup server. Option A provides network segmentation but no encryption. Option C encrypts only the transfer, not the data at rest.

Option D is a physical security measure and does not encrypt the data.

9
MCQmedium

A financial services firm requires zero data loss in the event of a primary data center failure. They operate two data centers 50 miles apart connected by a high-bandwidth, low-latency link. Which replication method should they use to meet this requirement?

A.Asynchronous replication every 15 minutes
B.Snapshot replication every hour
C.Backup replication nightly
D.Synchronous replication
AnswerD

Synchronous replication ensures that any write is committed to both replicas before being acknowledged, thus achieving RPO=0.

Why this answer

Option B is correct because synchronous replication writes data to both sites before acknowledging the write to the application, ensuring zero data loss (RPO=0). Asynchronous replication (Option A) introduces a delay and can lose the latest transactions. Snapshot replication (Option C) is point-in-time and not continuous, leading to potential data loss between snapshots.

Backup replication nightly (Option D) can lose up to a day's data.

10
MCQeasy

A database server hosts a critical application that requires a recovery point objective (RPO) of 4 hours. The company wants to minimize the impact on production performance during backups. Which backup strategy should be implemented?

A.Continuous data protection (CDP) with synchronous replication.
B.A weekly full backup with daily differential backups.
C.A weekly full backup with hourly incremental backups.
D.A nightly full backup.
AnswerC

Hourly incrementals ensure that no more than 1 hour of data is lost (well within the 4-hour RPO) and have minimal impact on production because they only back up changed data.

Why this answer

Option C is correct because hourly incremental backups meet the 4-hour RPO while minimizing resource usage compared to more frequent full backups or continuous replication. Option A is wrong because differential backups grow in size and can still exceed the RPO window. Option B is wrong because nightly full backups would fail to meet the 4-hour RPO if a disaster occurs hours after the last backup.

Option D is wrong because CDP with synchronous replication imposes high performance overhead and is unnecessary beyond the 4-hour RPO requirement.

11
PBQmedium

A healthcare provider is reviewing its disaster recovery strategy. They have two data centers: one primary in City A and a secondary in City B, 200 miles apart. Currently, they perform daily backups that are replicated to City B each night. In the event of a primary site failure, they can fail over to City B, but there is a 4-hour RTO due to manual processes. Their new RTO target is 2 hours, with an RPO of 15 minutes. The IT team is considering various replication technologies. The provider runs a mix of Windows and Linux servers hosting electronic health records (EHR), PACS imaging, and billing applications. Their current backup scheme is a full backup each night, with transaction logs backed up every 6 hours, but these are not immediately shipped offsite. They have experienced power outages in City A, prompting the review. The IT director is concerned about data consistency and quick recovery. The secondary site currently has sufficient hardware to run all critical applications, but data is only updated nightly. The link between data centers has 100 Mbps bandwidth and 10 ms latency, and upgrading it would cost $50,000. The existing staff can script failover procedures. Which solution best meets the new RPO and RTO while staying within budget?

A.Use application-level log shipping from the primary databases to secondary with a 5-minute delay, and manually failover.
B.Increase backup frequency to every 4 hours and use a warm site with pre-staged hardware, keeping the manual failover process.
C.Upgrade the inter-site link to 1 Gbps and implement synchronous replication for all critical VMs.
D.Implement asynchronous block-level replication with a 15-minute lag, and automate failover scripts to reduce RTO.
AnswerD

Why this answer

Option A is correct because asynchronous block-level replication with a 15-minute lag directly meets the RPO, and combining it with automated failover scripts can achieve the 2-hour RTO without requiring a costly bandwidth upgrade. Option B would meet the requirements but the link upgrade and synchronous replication infrastructure exceed the budget. Option C fails the RPO (4-hour backups are too infrequent) and RTO (manual failover is 4 hours).

Option D uses application log shipping that is not comprehensive (misses other servers) and manual failover would not meet the RTO.

12
MCQmedium

A system administrator configures full backups on Sunday evenings and differential backups on weekdays. On Thursday morning, a disk failure occurs. Which of the following sets of backups is necessary to completely restore the server's data with the fewest number of backup files?

A.Sunday full only
B.Sunday full, Monday differential, Tuesday differential, Wednesday differential
C.Sunday full and Thursday differential
D.Sunday full and Wednesday differential
AnswerD

Correct. Wednesday's differential contains all changes since Sunday, so only these two files are required for a full restore.

Why this answer

A differential backup includes all changes since the last full backup. Therefore, only the most recent differential and the last full backup are needed for a complete restore. Using Sunday's full and Wednesday's differential requires just two files, whereas incremental backups would require the full plus every incremental since.

Option A (full plus all four differentials) is unnecessary. Option C references a Thursday backup that hasn't occurred yet. Option D ignores all changes since Sunday.

13
MCQmedium

A company performs full backups every Sunday and differential backups daily. After a ransomware attack, they discover that both the production data and all attached backup media were encrypted. They need to ensure data can be recovered in the future. Which of the following is the BEST change to their backup strategy?

A.Store backups on an air-gapped or offline system.
B.Encrypt the backup data using AES-256.
C.Perform full backups daily instead of weekly.
D.Switch from differential to incremental daily backups.
AnswerA

Air-gapped backups are physically disconnected from the network, making them immune to remote ransomware attacks and ensuring data recoverability.

Why this answer

Option D is correct because air-gapped backups are physically isolated and cannot be reached by ransomware, ensuring recoverability. Option A increases backup frequency but doesn't protect against ransomware that encrypts attached media. Option B changes backup type but still leaves backups online and vulnerable.

Option C protects data at rest but if the encryption keys are on the same system, they can be compromised, and encryption itself doesn't prevent deletion/encryption by ransomware.

14
MCQhard

A company performs annual disaster recovery tests. The last test revealed that the recovery time objective (RTO) was not met because the backup tapes were corrupted. The backup administrator proposes changes to the backup verification process. Which practice is MOST effective to ensure recoverability?

A.Perform a full backup more frequently.
B.Implement automated integrity checks and periodic test restores.
C.Switch to disk-based backups exclusively.
D.Store backup tapes offsite only after verification.
AnswerB

Integrity checks (e.g., checksums) verify that backup data matches the expected state, and test restores confirm that the data can actually be recovered, addressing both media and logical corruption.

Why this answer

Option B is correct because automated integrity checks and periodic test restores directly validate that backups are usable and meet recovery objectives, catching corruption early. Option A is wrong because increasing backup frequency does not verify that backups are error-free. Option C is wrong because verifying tapes before offsite storage reduces risk but does not guarantee ongoing media integrity; tapes can degrade over time.

Option D is wrong because switching to disk-based backups avoids some tape-specific issues but still requires verification processes to ensure data is not corrupted.

15
PBQeasy

A small law firm relies on a single server that hosts a document management system and email. The server is backed up nightly using differential backups to an external USB hard drive that remains connected to the server. One Monday morning, the office manager finds all files encrypted and a ransom note on the screen. The server’s event logs indicate that the encryption began at 2:00 AM on Saturday. The firm’s offsite backup policy rotates two sets of tapes, and the most recent set was taken offsite on Friday evening and is stored in a bank safe deposit box. The USB backup drive, still attached to the server, shows its files also encrypted. The firm does not have a cloud backup service for the server. The office manager wants to restore operations as quickly as possible with minimal data loss and zero risk of reinfection. What is the BEST course of action?

A.Restore the server from the firm's cloud backup service for email.
B.Scan the USB drive with antivirus, then restore the latest differential backup from it.
C.Pay the ransom to obtain the decryption key, then perform a full backup.
D.Reimage the server, then restore data from the Friday offsite tape backup.
AnswerD

Why this answer

A is correct. The offsite tape backup from Friday evening is air-gapped and predates the infection (Saturday 2:00 AM), ensuring it is clean. Reimaging the server provides a known-good operating system.

Option B is risky because the USB drive’s backup likely contains infected files; even an antivirus scan might not detect all ransomware artifacts. Option C is not possible since there is no server cloud backup. Option D is not recommended and may not result in file recovery.

Thus, A is the safest and most reliable method.

16
Multi-Selecthard

Which THREE of the following are typically essential elements of a disaster recovery plan (DRP)? (Choose three.)

Select 3 answers
A.Emergency contact and communication plan
B.Server hardware specifications
C.Test and exercise schedule
D.Network topology diagram
E.Business impact analysis (BIA)
AnswersA, C, E

This plan ensures that all stakeholders can be notified and coordinated during a disaster, a core element of DRP.

Why this answer

Options A, C, and E are correct. A business impact analysis (A) identifies critical functions and recovery priorities. An emergency contact and communication plan (C) ensures key personnel are reachable.

A test and exercise schedule (E) validates the plan's effectiveness. Server hardware specifications (B) are operational details, not a core DRP element. A network topology diagram (D) supports recovery but is not always considered an essential DRP component; it is supplementary.

17
PBQhard

A medium-sized company uses a backup strategy that includes a full backup every Sunday at 2:00 AM and differential backups Monday through Saturday at 2:00 AM. The backups are written to a network-attached storage (NAS) device. On Thursday morning, the company experiences a ransomware attack that encrypts all data on the file server, including the NAS. The administrator needs to restore the file server with minimal data loss. The last successful full backup was from the previous Sunday, and differential backups were successful on Monday, Tuesday, and Wednesday. However, Thursday's differential was not completed because the attack occurred before the scheduled time. The administrator attempts to restore using the Sunday full backup and Thursday's differential, but the restore fails because the differential backup on the NAS is also encrypted. Which of the following is the best course of action?

A.Pay the ransom to decrypt the differential backup
B.Restore from the Sunday full backup and Wednesday's differential backup
C.Reinstall the operating system and restore files from cloud storage
D.Restore using only Wednesday's differential backup
AnswerB

Why this answer

The most recent clean backup set is Sunday's full plus Wednesday's differential, as both were taken before the ransomware attack. Restoring from these will recover data as of Wednesday's backup, minimizing data loss. Using only Wednesday's differential requires the full backup first.

Paying the ransom is not recommended and may not work. Reinstalling the OS and restoring from cloud would not apply because cloud was not mentioned.

18
MCQmedium

Refer to the exhibit. An administrator is reviewing logs after a server experienced performance issues and unexpected shutdowns. Based on the log entries, which component is MOST likely failing?

A.RAID controller
B.RAM module
C.Hard disk drive
D.Power supply
AnswerC

Medium errors and failed sector reallocation are direct indicators of physical hard disk drive failure.

Why this answer

The log entries show multiple SCSI medium errors, unrecovered read errors, and auto-reallocation failures on device sda, which are classic signs of a failing hard disk drive (Option B). A RAID controller (A) would typically show different errors, RAM (C) would cause memory-related errors, and a power supply (D) would trigger power event logs.

19
MCQhard

A company uses a two-node failover cluster for a critical application. The cluster nodes are located in the same data center, and the quorum configuration uses a file share witness on a separate server in the same data center. During a major power outage, both cluster nodes and the file share witness server lose power. What is the impact on cluster availability?

A.The cluster will automatically fail over to a third site because the witness server is unavailable.
B.The cluster continues operating because the nodes can use a dynamic quorum and adjust the vote count.
C.The cluster will be offline until one of the nodes or the witness comes back online.
D.The cluster remains online because the nodes can communicate directly and form quorum without the witness.
AnswerC

With all three voting members down, there are zero votes, below the quorum majority. The cluster will not start until at least two members are available (e.g., both nodes, or one node and the witness).

Why this answer

In a two-node cluster with a file share witness, if both nodes and the witness are unavailable, the cluster cannot achieve quorum and will be offline. This is because the cluster requires a majority of votes to stay online. With only two nodes, the witness is needed to break ties.

Without any votes, the cluster fails.

20
PBQhard

A medium-sized e-commerce company operates three critical servers: a web front-end, a database server, and a file server. Currently, a full backup of all servers is performed every Sunday starting at 11:00 PM and completes in about 6 hours. Differential backups run each weekday at 11:00 PM, taking roughly 2 hours. On a Wednesday at 10:00 AM, a ransomware attack encrypts all data on all servers. The IT team’s incident response plan requires restoration with an RPO of 4 hours and an RTO of 8 hours. The latest clean backup is Tuesday’s differential, resulting in approximately 10 hours of data loss. Future attacks could occur at any time. Management is willing to spend up to $200 per month to improve the backup strategy but cannot afford new hardware or a dedicated hot site. The team needs a solution that reduces both RPO and RTO within budget while maintaining simplicity for a small IT staff of two. Which of the following backup strategies should be implemented to best meet these requirements?

A.Switch to daily full backups to a local NAS, which takes 8 hours.
B.Adopt real-time replication to a hot site located offsite.
C.Continue the current strategy but increase the frequency of differential backups to every 4 hours.
D.Implement hourly incremental backups with daily full backups to a cloud backup service, costing $50/month.
AnswerD

Why this answer

B is correct. Hourly incremental backups with daily fulls to a cloud service gives a maximum data loss of about one hour (if failure right before an incremental), meeting the 4-hour RPO. Daily full backups ensure faster restoration since only the last full and up to a few incrementals need to be applied, likely achieving an 8-hour RTO.

The $50/month cost is within budget. Option A (daily full to NAS) extends the backup window to 8 hours and may not meet RPO if an attack occurs between backups. Option C (more frequent differentials) will cause backup times to grow, potentially exceeding the window, and still may have a 4-hour RPO gap if scheduled every 4 hours but an attack occurs after the last.

Option D is cost-prohibitive. Thus, B is feasible and effective.

21
PBQeasy

A small business has a single file server running Windows Server 2019. The server uses two internal SATA drives in a RAID 1 mirror for the operating system and data. The company's backup solution performs a full backup every night to an external USB hard drive, which is stored in the server room. The IT administrator recently noticed that the server's system volume is running low on space and decides to migrate the data to a larger drive. During the migration, the server crashes and will not boot. The administrator attempts to restore from the latest backup but finds that the backup drive is corrupted and cannot be read. The company has no offsite backups. What should the administrator have done to prevent this situation?

A.Regularly test backup restorations to verify data integrity.
B.Implement a RAID 5 array instead of RAID 1 for better redundancy.
C.Document the backup procedure and create a disaster recovery plan.
D.Use a cloud-based backup service with offsite storage.
AnswerA

Why this answer

The correct answer is D: Regularly test backup restorations to verify data integrity. The administrator assumed backups were valid without verification. Option A is wrong because RAID 1 provides redundancy but does not protect against corruption or accidental deletion; the issue here is backup corruption.

Option B is wrong because cloud backup is a good practice but not strictly required; the root cause is lack of backup testing. Option C is wrong because while documentation is helpful, it would not prevent data loss from a corrupted backup drive.

22
PBQhard

A large enterprise uses a centralized backup solution with a backup server running Commvault. Backups are stored on a deduplicated disk array and replicated to a secondary site for disaster recovery. The company's security team detects ransomware activity that has encrypted several file servers. The backup administrator checks the backup repository and finds that the backup data is also encrypted because the backup service account had permissions to modify backup files, and the ransomware propagated to the repository. The last known good backup is from two weeks ago, which is too old for the organization's RPO of 24 hours. The backup administrator is under pressure to restore operations quickly. Which of the following should the administrator implement to prevent this from recurring?

A.Immutable backup storage and a dedicated service account with least-privilege access.
B.Encrypt all backup data at rest and in transit.
C.Require multi-factor authentication for the backup service account.
D.Air-gap the backup repository by disconnecting it from the network except during backup windows.
AnswerA

Why this answer

The correct answer is A: Implement immutable backup storage and use a separate service account with write permissions only during backup windows. Immutable backups cannot be modified or deleted by any user or process, including ransomware. Option B is wrong because air-gapping alone does not prevent access if the backup server is compromised; immutable storage is more robust.

Option C is wrong because while MFA is a good security practice, it does not protect backups that are already accessible with valid credentials. Option D is wrong because encryption of backup data protects it during transit or while stored, but does not prevent the ransomware from encrypting the files if the backup system is accessible.

23
PBQmedium

A medium-sized company runs an e-commerce platform on a cluster of three physical servers hosting virtual machines. The disaster recovery plan includes daily backups to a remote data center using Veeam Backup & Replication. The company's annual disaster recovery drill is scheduled for next week. During the drill, the IT team plans to simulate a complete site failure by powering off the primary data center. The recovery time objective (RTO) is 4 hours, and the recovery point objective (RPO) is 1 hour. The team successfully restores the VMs at the remote site, but the application experiences significant performance degradation and many transactions fail due to database inconsistency. Investigation reveals that the backup was taken at 2:00 AM, but the failure occurred at 10:00 AM, and the application's database had transactions between 2:00 AM and 10:00 AM that were not captured. What should the IT team do to improve the recovery process?

A.Configure RAID 10 on all database servers to improve disk performance.
B.Upgrade the WAN connection between sites to reduce backup transfer times.
C.Enable log shipping with point-in-time recovery for the database.
D.Adjust the RTO to 8 hours to allow for more comprehensive backups.
AnswerC

Why this answer

The correct answer is B: Implement log shipping with point-in-time recovery for the database. The RPO of 1 hour is not being met because the backup schedule is daily. Option A is wrong because while a faster WAN can reduce backup time, the core issue is the backup frequency, not bandwidth.

Option C is wrong because the issue is not data redundancy but recovery granularity; RAID protects against drive failure but not data loss from missing transactions. Option D is wrong because increasing RTO does not solve the RPO violation; the goal is to reduce data loss, not relax the time target.

24
MCQmedium

Refer to the exhibit. A backup job to a network share failed. The administrator reviews the backup log. What is the most likely cause of the failure?

A.The backup user account lacks appropriate permissions.
B.The backup server is powered off.
C.The network link is down.
D.The backup file path exceeds the maximum length.
AnswerA

The 'Access is denied' error is a classic indication of insufficient NTFS or share permissions on the target folder.

Why this answer

Option B is correct. The 'Access is denied' error clearly indicates a permissions problem—the backup user account does not have the necessary rights to write to the share. Option A would present a 'network path not found' or 'host unreachable' error.

Option C would also indicate network unreachable, not access denied. Option D would typically produce a 'path too long' error, not access denied.

25
MCQeasy

A financial services firm requires a disaster recovery solution that provides a Recovery Point Objective (RPO) of near zero and a Recovery Time Objective (RTO) of less than 2 hours. Which of the following site types is MOST appropriate?

A.Cloud-based backup with daily replication
B.Cold site
C.Warm site
D.Hot site
AnswerD

A hot site maintains near real-time synchronization and redundant hardware, allowing rapid failover with minimal data loss and downtime.

Why this answer

Option D is correct because a hot site is fully equipped, with near real-time data replication, enabling the fastest recovery and minimal data loss. A cold site (Option A) has the longest recovery time. A warm site (Option B) has some equipment but data must be restored from backup, increasing RTO and RPO.

Cloud-based backup with daily replication (Option C) does not meet near-zero RPO.

26
PBQmedium

A regional hospital operates two data centers located 10 miles apart, with synchronous replication of critical patient record systems between them. The replication ensures that any write to the primary storage is immediately mirrored to the secondary site. The hospital also maintains weekly full backups to LTO-8 tapes, which are stored in a fireproof safe at an offsite warehouse 30 miles away. The IT team has not implemented storage snapshots or continuous data protection due to budget constraints. Last week, a ransomware attack encrypted all files on the primary site. The replication process promptly mirrored the encrypted data to the secondary site, rendering both copies inaccessible. The attackers demanded $500,000 in Bitcoin. The hospital's disaster recovery plan specifies an RPO of 1 hour and an RTO of 4 hours. The IT director must now choose a restoration strategy that minimizes data loss and downtime while ensuring a clean, malware-free environment. The backup tapes are confirmed to be unencrypted and free of ransomware. Which of the following actions should the IT director take first?

A.Pay the ransom demand to obtain the decryption key and decrypt both sites.
B.Restore the most recent tape backup to the primary site and re-enable replication.
C.Fail over to the secondary data center and attempt to decrypt the ransomware using available tools.
D.Wipe the secondary data center storage, restore from the latest clean tape backup at the secondary site, and then reverse replication to the primary.
AnswerD

Why this answer

Option C is correct because both the primary and secondary copies are encrypted, so the only clean data source is the offsite tape. Wiping the secondary site, restoring from tape there, and then reversing replication to the primary ensures a malware-free environment and uses the existing replication infrastructure to bring the primary back online quickly, potentially within the 4-hour RTO. Option A is unrealistic since no decryption tool is available for modern ransomware without the key.

Option B runs the risk of the primary becoming reinfected if any remnants remain, and it leaves the encrypted secondary uncorrected. Option D is inadvisable as paying the ransom does not guarantee data recovery and funds criminal activity.

27
MCQeasy

A small business has a limited budget and can tolerate up to 72 hours of downtime in the event of a disaster. Which type of disaster recovery site would be most cost-effective?

A.Cloud-based DR with pay-as-you-go.
B.Cold site with no pre-configured hardware.
C.Hot site with real-time replication.
D.Warm site with pre-installed hardware but no data.
AnswerA

Cloud DR allows the business to pay only when resources are consumed, eliminating upfront investment and ongoing idle hardware costs, ideal for a limited budget and relaxed RTO.

Why this answer

Option D is correct because a cloud-based DR site with pay-as-you-go model requires no upfront investment in hardware and can be spun up as needed, making it cost-effective for a business with a high downtime tolerance. Option A is wrong because a hot site is the most expensive, with real-time replication. Option B is wrong because a warm site requires pre-installed hardware that incurs ongoing costs, even if data is not up-to-date.

Option C is wrong because a cold site still requires occasional maintenance and may have hidden costs; modern cloud DR can be cheaper and more flexible.

28
MCQmedium

A financial services firm requires a disaster recovery site that provides immediate failover with zero data loss. Which type of site should they implement?

A.A warm site with asynchronous replication.
B.A cloud-based site with daily snapshots.
C.A cold site with tape restoration.
D.A hot site with synchronous replication.
AnswerD

Synchronous replication ensures data is mirrored in real-time, enabling immediate failover with no data loss.

Why this answer

Option A is correct because a hot site with synchronous replication ensures that data is written to both primary and secondary sites simultaneously, providing zero RPO and immediate failover. Option B (warm site) requires some time to bring systems online, leading to downtime and potential data loss. Option C (cold site) involves significant setup time and last-known-good backup restoration.

Option D (cloud with daily snapshots) introduces an RPO of up to 24 hours, not zero data loss.

29
PBQmedium

A mid-sized manufacturing company operates a primary data center with all critical servers. They have a warm standby site located 100 miles away. For databases, the primary SAN uses synchronous replication to the standby SAN; no tape backups are taken for databases. File and application servers are backed up to an on-premises tape library using nightly incrementals with a weekly full backup every Sunday. Tapes are shipped off-site every Monday morning. On Tuesday morning, a ransomware attack encrypts the entire primary SAN. Because of the real-time replication, the standby SAN is encrypted almost instantly. The on-site tape library is also connected to the network and its tapes, including Sunday's full and Monday's incremental, are encrypted by the attack. The most recent off-site shipment was the previous Monday (eleven days ago), meaning the off-site tapes contain a full backup from eleven days ago and daily incrementals up to that point. The company's RPO is 1 hour for databases and 24 hours for file servers; RTO is 8 hours. The IT director must decide the best immediate course of action to restore operations while adhering to the DR plan as closely as possible.

A.Rebuild all database servers from scratch and restore file servers from the most recent off-site tapes, accepting 11 days of data loss for file servers too.
B.Attempt to restore the databases from the replicated SAN by breaking replication and scanning for uncorrupted blocks.
C.Pay the ransom demand to the attackers in hopes of receiving the decryption key.
D.Restore all systems from the 11-day-old off-site tapes, accepting the loss of data generated during the last 11 days.
AnswerD

Why this answer

Option D is correct because the off-site tapes are the only clean, unaffected backups available. Restoring from them is the only way to avoid paying the ransom and to ensure data integrity, even though it means losing 11 days of data. Option A is wrong because paying the ransom does not guarantee data recovery, encourages further crime, and may not meet compliance requirements.

Option B is wrong because the replicated SAN data is already encrypted and likely unrecoverable without the decryption key. Option C is wrong because rebuilding databases from scratch is unnecessary when the off-site tapes include database backups (from the full/incremental set) and would result in far greater data loss.

30
MCQhard

A network administrator needs to configure centralized authentication for network devices. The solution must provide encryption of the entire authentication process, support for multiple protocols, and accounting of user actions. Which protocol should be used?

A.TACACS+
B.Kerberos
C.RADIUS
D.LDAP
AnswerA

TACACS+ encrypts the entire body of the packet, supports multiple protocols, and provides detailed accounting, fitting the requirements.

Why this answer

TACACS+ encrypts the entire authentication process, offers granular control over authorization, and supports accounting. RADIUS (B) only encrypts the password, not the entire session. LDAP (A) is a directory service, not an encryption-focused authentication protocol.

Kerberos (C) uses tickets and encryption but is primarily for single sign-on within a domain, not commonly used for network device administration.

31
MCQmedium

A system administrator needs to configure secure remote access to servers in the data center. The current setup uses password-based SSH, but the security policy mandates multifactor authentication and prevention of brute-force attacks. Which solution best meets these requirements?

A.Implement SSH key authentication only.
B.Use SSH with public key authentication and install fail2ban.
C.Deploy a VPN with certificate-based authentication and enable MFA.
D.Enable RDP with network-level authentication.
AnswerC

A VPN secures the entire communication channel, certificates provide strong machine-level trust, and MFA adds the required second factor for user authentication.

Why this answer

Option C is correct because a VPN with certificate-based authentication provides strong encryption and identity verification, and enabling MFA adds an extra layer of security that satisfies the multifactor mandate. Option A is wrong because SSH key authentication alone does not provide MFA; an attacker with the key can still connect. Option B is wrong because while fail2ban helps against brute-force, it does not implement MFA.

Option D is wrong because RDP is less secure for remote server administration and NLA does not constitute full MFA.

32
MCQhard

A system administrator notices unusual file encryption activity on a file server. The activity appears to be rapidly spreading to other servers, and ransom notes are appearing. Which of the following should the administrator do FIRST?

A.Notify law enforcement
B.Run antivirus scan on the affected servers
C.Disconnect the affected servers from the network
D.Restore the encrypted files from backup
AnswerC

Immediate isolation is the first step in incident response to contain the damage and prevent the ransomware from spreading to other systems.

Why this answer

Option B is correct because the immediate priority in a ransomware outbreak is to contain the threat by disconnecting affected systems from the network, preventing further lateral movement and encryption of additional assets. Restoring from backup (Option A) is a recovery step that should occur after containment. Notifying law enforcement (Option C) is important but secondary to stopping the spread.

Running an antivirus scan (Option D) may be ineffective on already encrypted systems and wastes time that should be spent on containment.

33
MCQhard

Refer to the exhibit. A Linux server's local firewall is configured as shown. The administrator is unable to perform backups to a network-attached storage (NAS) device using TCP port 10000. Which firewall rule is causing the issue?

A.The INPUT policy is set to ACCEPT.
B.The DROP all rule at the end blocks all traffic except SSH.
C.The NAS device uses a different subnet.
D.The SSH ACCEPT rule is allowing traffic.
AnswerB

The DROP rule matches all packets that were not explicitly accepted (only port 22), including the backup traffic on port 10000.

Why this answer

Option D is correct. The INPUT chain contains an explicit DROP all rule at the end, which blocks any traffic not explicitly allowed. The only allowed traffic is SSH on port 22.

The backup traffic on port 10000 matches the DROP rule and is therefore dropped. Option A is incorrect because the policy ACCEPT is overridden by the explicit DROP. Option B allows SSH traffic but does not affect port 10000.

Option C about subnets is irrelevant to the local firewall shown.

34
MCQeasy

A small business needs a disaster recovery site that can be brought online within 2 hours of a primary site failure. The business can tolerate minimal data loss. Which type of recovery site should they implement?

A.Cold site
B.Hot site
C.Warm site
D.Mobile site
AnswerB

A hot site offers real-time data replication and ready-to-run systems, allowing failover within minutes to a couple of hours, achieving minimal data loss.

Why this answer

Option C is correct because a hot site maintains near-real-time data replication and preconfigured hardware, enabling failover within 2 hours and minimal data loss. A cold site (Option A) requires hardware setup and data restoration, taking days. A warm site (Option B) has pre-installed hardware but lacks current data, typically taking hours to a day to activate.

A mobile site (Option D) is a portable solution with variable provisioning time and may not meet the 2-hour requirement consistently.

35
MCQeasy

A company performs a full backup on Sunday and incremental backups Monday through Saturday. A server fails on Thursday at 10:00 AM. Which sequence correctly restores the data?

A.Restore Sunday full, then Tuesday and Wednesday incrementals.
B.Restore Sunday full and Wednesday incremental only.
C.Restore Wednesday's incremental, then Sunday full.
D.Restore Sunday full, then Monday, Tuesday, and Wednesday incrementals.
AnswerD

Correct sequence: full backup provides the base, and all subsequent incremental backups up to the last good point (Wednesday) must be applied in order.

Why this answer

Option C is correct because an incremental backup captures only changes since the last backup, requiring the last full backup and all subsequent incrementals up to the point of failure. Options A and D are wrong because they skip Monday’s incremental (A) or both Monday and Tuesday (D). Option B is wrong because it restores out of order, which would not apply the data correctly.

36
PBQhard

A mid-sized e-commerce company experienced a ransomware attack that encrypted all on-premises servers and their locally attached backup storage. The attack occurred on a Friday evening; the company was closed over the weekend. By Monday morning, the IT team discovered the encryption and found a ransom note demanding $500,000 in Bitcoin. The company has a disaster recovery plan that calls for restoring from daily tape backups stored offsite. However, the most recent offsite tape was taken home by a backup operator for the weekend and has not been returned. The tape contains full backups from Wednesday. The IT team has clean installation media and application software available. The company's RPO is 24 hours, and RTO is 48 hours. Management wants to minimize data loss and avoid paying the ransom. Based on this scenario, which of the following should the IT team do to recover the business operations?

A.Pay the ransom to obtain the decryption key, then restore the environment, and implement better security controls.
B.Rebuild the servers from scratch using clean media, and manually re-enter transactions since the last good backup based on paper records and customer emails.
C.Wait for the backup operator to return the tape, then restore from that tape, accepting data loss since Wednesday.
D.Rebuild the servers from scratch using clean media, restore the latest offsite tape if available, and apply available transaction logs from the on-premises backup server that was encrypted (attempting to recover unencrypted logs).
AnswerD

Why this answer

Option A is correct because it follows the existing DR plan by restoring from the available offsite tape (even though a few days old) and builds clean servers to avoid reinfection. It also attempts to salvage any unencrypted transaction logs from the compromised environment to minimize data loss beyond Wednesday. Paying the ransom (Option B) is against best practices and may not guarantee full recovery.

Waiting for the operator to return the tape (Option C) delays action and may still result in significant data loss; the operator's return is uncertain. Manually re-entering transactions (Option D) is highly labor-intensive, error-prone, and could exceed the 48-hour RTO.

37
PBQhard

A large financial services company must comply with federal regulations mandating quarterly disaster recovery tests. Their primary data center in New York hosts all trading applications, and a hot site in Chicago is maintained with real-time data replication via synchronous mirroring. During the last DR test, the IT team successfully failed over network and storage within 8 minutes, meeting the 15-minute RTO for connectivity. However, they encountered a major issue: the hot site's firewalls, intrusion detection systems, and application-level access controls were not configured to match the primary environment. The security team had to manually create firewall rules, update IDS signatures, and reconfigure access policies based on documentation, which took over 4 hours. As a result, the total system readiness exceeded 4.5 hours, causing a significant gap in trading operations. The regulatory auditor noted this deficiency and required a corrective action plan. The company must ensure that the next DR test achieves full operational readiness, including security controls, within the 15-minute RTO. The IT budget is already allocated for the current fiscal year, so large capital expenditures are not possible, but the team can leverage existing tools and automation. Which of the following is the BEST approach to address this issue?

A.Develop detailed runbooks for the security team to manually configure devices during failover; then conduct quarterly drills to reduce configuration time.
B.Re-evaluate the RTO to extend it to 4 hours and inform regulators of a realistic capability.
C.Replace the existing firewalls and IDS at the hot site with identical hardware from the same vendors as the primary site.
D.Implement a configuration management tool that automatically synchronizes firewall rules, IDS signatures, and access controls to the hot site in near real-time.
AnswerD

Why this answer

Option A is correct because implementing a configuration management or synchronization tool directly addresses the root cause—manual configuration—by automating the replication of security policies to the hot site in near real-time. This eliminates human error and delay, meeting the 15-minute RTO without requiring new hardware. Option B (detailed runbooks and drills) still relies on manual interaction, which is unlikely to achieve 15-minute readiness.

Option C merely lowers the standard instead of fixing the process and would likely be rejected by regulators. Option D (identical hardware) does not automatically transfer configurations; they would still need to be applied, so it does not solve the time problem.

38
PBQeasy

A small law firm has a single on-premises server running their case management software, email, and document storage. They perform a full backup each night at 11 PM to an external USB 4 TB drive, which is then stored on a shelf in the server room. The server room is located in the basement of their office building. Last week, an electrical fire started in the server room, completely destroying the server and the backup drive. The firm lost all data since the last backup, and it took two weeks to procure new hardware and restore from an older, off-site backup that was taken during a manual process three months ago. Their insurance company now requires a formal disaster recovery plan. The firm has a limited budget and minimal IT staff. They want to prevent data loss and minimize downtime in future disasters. What is the BEST course of action to improve their disaster recovery capabilities?

A.Subscribe to a cloud backup service that performs automatic daily backups to a remote data center.
B.Increase backup frequency to every hour and store the drive in a desk drawer in a different room on the same floor.
C.Purchase a fireproof safe for the server room and store the USB backup drive in it after each backup.
D.Install a second server on-site and configure real-time mirroring between the two servers.
AnswerA

Why this answer

Option B is correct because cloud backup automatically sends data to a remote location, satisfying the off-site requirement of the 3-2-1 backup rule, is cost-effective for a small firm, and requires little IT overhead. Option A is wrong because mirroring on-site still leaves them vulnerable to site-wide disasters like fire. Option C is wrong because a fireproof safe does not protect against all disaster types and keeps the backup on-site.

Option D is wrong because it still stores the backup on-site, increasing cost and management without solving the off-site need.

39
MCQmedium

An organization's disaster recovery plan specifies an RPO of 4 hours. Their current backup schedule performs a full backup at midnight and incremental backups every 2 hours from 8:00 AM to 8:00 PM. A server failure occurs at 3:00 AM, and data created after 8:00 PM the previous day is permanently lost. Which of the following is the MOST likely reason?

A.The incremental backups were not synthetically rolled into the full backup.
B.The RPO was set too low for the business requirements.
C.There is a gap in the backup schedule overnight that exceeds the RPO.
D.The backup media became corrupted.
AnswerC

The schedule only covers 8:00 AM–8:00 PM with incrementals, leaving a long interval overnight where no backups capture data changes, violating the 4-hour RPO.

Why this answer

Option C is correct because the backup schedule has no coverage from 8:00 PM to 8:00 AM the next morning (except full at midnight), creating a 12-hour gap overnight that exceeds the 4-hour RPO. Data created after 8:00 PM and before the failure at 3:00 AM is lost because no backup captured it. Option A is incorrect because RPO is a requirement, not the cause.

Option B is speculative. Option D refers to synthetic fulls, which are not relevant to this gap.

40
MCQhard

Refer to the exhibit. A server administrator is reviewing security logs after a suspected brute-force attack on the SSH service. The following excerpt from /var/log/secure is displayed. Which security control would have been MOST effective in preventing the successful login?

A.Disabling root login via SSH.
B.Implementing fail2ban or similar intrusion prevention.
C.Enforcing a strong password policy.
D.Using a different SSH port.
AnswerB

fail2ban tracks authentication failures and temporarily or permanently bans IPs that exceed the threshold, which would have blocked 192.168.1.100 after the initial failures, preventing the successful login.

Why this answer

Option B is correct because fail2ban or a similar intrusion prevention system monitors logs for repeated failures and blocks the attacker's IP address after a configurable number of attempts, stopping the attack before the correct password is guessed. Option A is wrong because a strong password policy might resist guessing for a long time, but the admin password was eventually guessed; it does not actively prevent repeated attempts. Option C is wrong because disabling root login would not have prevented the attack on the admin account, which was the one compromised.

Option D is wrong because changing the SSH port is security through obscurity and does not prevent brute-force attempts once the port is discovered.

41
MCQeasy

An organization wants to test its disaster recovery plan with minimal disruption to business operations and minimal cost. The test should verify the plan's effectiveness by discussing scenarios. Which type of test should they perform?

A.Tabletop exercise
B.Parallel test
C.Full interruption test
D.Simulation test
AnswerA

A tabletop exercise is a walk-through discussion that incurs almost no direct cost and zero disruption, making it ideal for initial plan verification.

Why this answer

Option C is correct because a tabletop exercise is a discussion-based review of the plan steps with key stakeholders, requiring no system downtime and very low cost. A full interruption test (Option A) actually shuts down primary systems and fails over, causing disruption. A parallel test (Option B) runs systems at the DR site without cutting over but still involves significant resource allocation.

A simulation test (Option D) may involve live drills or emulate components, often costing more than a tabletop.

42
Multi-Selecteasy

During a security incident, a server is suspected to be compromised by malware. The incident response team needs to preserve evidence and minimize impact. Which TWO actions should be taken FIRST? (Select TWO.)

Select 2 answers
A.Disconnect the server from the network.
B.Run an antivirus scan.
C.Reboot the server in safe mode.
D.Power off the server immediately.
E.Make a forensic image of the system memory.
AnswersA, E

Isolating the server from the network stops the attacker's remote access and prevents malware propagation while preserving the system state for investigation.

Why this answer

Options B and C are correct. Disconnecting the server from the network (B) is an immediate containment step to prevent data exfiltration or spread. Capturing a forensic image of system memory (C) preserves volatile data such as running processes, network connections, and encryption keys before they are lost.

Option A is wrong because powering off loses all volatile evidence. Option D is wrong because running an AV scan modifies files and could destroy forensic artifacts. Option E is wrong because rebooting erases memory and may trigger malware countermeasures.

43
Multi-Selectmedium

A company is creating a disaster recovery plan for its on-premises data center. Which THREE elements are essential to include in the DR plan? (Select THREE.)

Select 3 answers
A.Contact information for key personnel.
B.RTO and RPO for each critical system.
C.Detailed instructions for cleaning server hardware.
D.Step-by-step procedures for performing backups.
E.List of failover site addresses and access procedures.
AnswersA, B, E

During a disaster, communication is vital; the plan must include up-to-date contact details for the response team, stakeholders, and vendors.

Why this answer

Options A, C, and E are correct. Contact information for key personnel (A) ensures that the recovery team can be reached during a crisis. RTO and RPO for each critical system (C) define the recovery goals and guide the technical implementation.

The list of failover site addresses and access procedures (E) provides vital instructions for reaching and securing the secondary location. Option B is wrong because cleaning procedures are operational but not a core DR plan element. Option D is wrong because backup procedures are part of the backup policy, not the disaster recovery plan; the DR plan assumes backups exist and focuses on restoring from them.

44
MCQmedium

After an unexpected power outage, a server fails to boot and displays an error indicating a degraded RAID array. The server has a RAID 5 configuration with four disks. One disk has failed, but the hot spare did not automatically rebuild. The administrator needs to restore data availability as quickly as possible. Which action should the technician take FIRST?

A.Replace the failed disk and initiate a manual rebuild.
B.Restore the server from the latest backup.
C.Check the RAID controller battery and cache.
D.Replace the hot spare with a new disk.
AnswerA

The failed disk is the root cause of degradation. Replacing it provides a healthy member for the array, and a manual rebuild can be forced to restore redundancy quickly.

Why this answer

Option A is correct because replacing the failed disk and initiating a manual rebuild directly restores redundancy and availability using the existing parity data. Option B is wrong because the hot spare is not faulty; the rebuild did not trigger automatically, likely due to a configuration issue, and swapping it does not address the failed disk. Option C is wrong because while a bad battery or cache can cause rebuild failures, checking this is a later step; the immediate need is to replace the failed disk to restore redundancy.

Option D is wrong because a backup restore is a last resort and may result in data loss; the array is degraded but still functional, so rebuilding is faster and less disruptive.

Ready to test yourself?

Try a timed practice session using only security-disaster-recovery questions.