CISA Practice Question: Information Systems Operations and Business Resilience
Which backup method copies all data that has changed since the last full backup, regardless of subsequent incremental backups, and is often used to reduce restore time?
⚠ Common exam trap
Many exam-takers confuse differential backups with incremental backups, as both copy only changed data, but the key distinction is that differentials copy all changes since the last full backup, while incrementals copy changes since the last backup of any type, leading to longer restore chains for incrementals.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Differential backup
A differential backup copies all data that has changed since the last full backup, regardless of any incremental backups taken in between. This approach reduces restore time because only the last full backup and the most recent differential backup are needed, unlike incremental backups which require the full backup plus every subsequent incremental in sequence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Full backup
Why it's wrong here
A full backup copies everything, not just changes since the last full backup, so it cannot deliver the differential restore behaviour described. It is tempting because it is the baseline every other method references and the correct choice when the stem asks for a complete, self-contained copy.
- ✓
Differential backup
Why this is correct
A differential backup copies every change since the last full backup, accumulating successive modifications regardless of intervening incremental runs. This cumulative approach means only the latest full plus one differential are needed for restore, reducing restore time compared with incremental chains.
- ✗
Incremental backup
Why it's wrong here
Incremental backups capture only changes since the previous backup of any type, so a restore needs the last full plus every subsequent incremental. Differential is the method that accumulates all changes since the last full backup, giving faster restores from two sets.
- ✗
Mirror backup
Why it's wrong here
A mirror backup replicates a full copy of the source, typically the latest state only, so it captures no historical changes and cannot restore to an earlier point. It is tempting because it is complete, and it would be correct for maintaining an exact duplicate of current data.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.