GSEC Security Frameworks and CIS Controls Practice Question
An organization is reviewing CIS Control 11: Data Recovery. Which of the following activities best demonstrates adherence to the 'testing' requirement of this control?
⚠ Common exam trap
Candidates often equate 'testing' with simply verifying that a backup job completed successfully. They miss that the actual requirement is to perform a restoration to verify data integrity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conducting a periodic, documented restore process to verify data integrity.
The testing requirement in CIS Control 11 is critical because backups are useless if they cannot be successfully restored. Organizations must not only perform regular backups but also systematically test those backups to verify data integrity and recovery speed. This ensures that in the event of a ransomware attack or accidental data loss, the organization has a reliable, validated path to restore operations quickly and minimize downtime effectively.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Running a full system backup every night at 2:00 AM.
Why it's wrong here
Running a backup is a standard operational task, but it does not verify that the data is recoverable. Without performing a test restore, the organization has no assurance that the backup files are not corrupted or that the restoration process itself will be successful when actually needed.
- ✗
Storing all backup tapes in an off-site, climate-controlled facility.
Why it's wrong here
Off-site storage is a best practice for disaster recovery and physical security, but it does not constitute a test of the recovery process. Proper storage protects the physical media, but it does not address the logical integrity of the data or the capability to restore it successfully.
- ✓
Conducting a periodic, documented restore process to verify data integrity.
Why this is correct
Performing a documented, periodic restore test is the core requirement for Control 11. It proves that the backup system is working as intended, data is not corrupted, and the team knows the necessary steps to recover critical business systems within the required recovery time objectives after an incident.
- ✗
Encrypting all backup media to prevent unauthorized access.
Why it's wrong here
Encryption is an essential security requirement for protecting backup data from unauthorized disclosure, but it is not a test of the recovery process. A backup could be perfectly encrypted and stored securely, yet still fail to restore due to formatting issues, logical errors, or hardware failure.
About these practice questions
One of 351 original GSEC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GSEC practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GSEC exam.