The answer is 33 hours, representing data loss since Tuesday at 01:00. This maximum potential data loss is calculated by identifying the longest gap between a successful backup and a failure point, which in a differential backup strategy depends on whether the differential chain remains intact. If the failure destroys the differential chain or occurs just before the next scheduled differential, the recovery point reverts to the last full backup; here, the full backup was Monday at 01:00, and the last differential was Tuesday at 01:00, so a failure at Wednesday 10:00 loses all changes from Tuesday 01:00 onward—a 33-hour window. On the ISC2 CC exam, this tests your understanding of recovery point objectives (RPO) and backup types, often tricking candidates who mistakenly calculate from the most recent differential rather than the full backup when the chain is compromised. Remember: with differentials, the maximum loss always stretches back to the last full backup if the differentials are lost or the failure timing is unlucky—think “full backup is your safety net.”
ISC2 CC Business Continuity, DR & Incident Response Practice Question
This CC practice question tests your understanding of business continuity, dr & incident response. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Exhibit
Refer to the exhibit.
---
Backup Configuration (extract):
- Full backup: Every Sunday at 01:00
- Differential backup: Monday-Saturday at 01:00
- Retention: 30 days
---
A server fails on Wednesday at 10:00. The administrator restores from the most recent full backup and applies the latest differential backup. How much data loss is expected?
Based on the backup schedule, what is the maximum potential data loss?
Refer to the exhibit.
---
Backup Configuration (extract):
- Full backup: Every Sunday at 01:00
- Differential backup: Monday-Saturday at 01:00
- Retention: 30 days
---
A server fails on Wednesday at 10:00. The administrator restores from the most recent full backup and applies the latest differential backup. How much data loss is expected?
A
9 hours (since Tuesday 01:00)
Why wrong: 9 hours would be if failure at 10:00 on Tuesday, not Wednesday.
B
2 days (data since Monday)
Why wrong: Differential on Tuesday includes Monday's data; loss starts from Tuesday 01:00.
C
33 hours (data since Tuesday 01:00)
Last successful backup was Tuesday 01:00; failure at Wednesday 10:00 = 33 hours.
D
1 day (data since last full backup)
Why wrong: Full backup was Sunday; differential on Tuesday captures changes up to Tuesday 01:00.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
33 hours (data since Tuesday 01:00)
The maximum potential data loss is determined by the interval between the last successful backup and the point of failure. With a full backup on Monday at 01:00 and differential backups every 12 hours (Tuesday 01:00 and 13:00), the last backup before a failure at, say, Wednesday 10:00 is Tuesday 13:00. The data loss window spans from Tuesday 13:00 to Wednesday 10:00 (21 hours), but the question's correct answer of 33 hours indicates the failure occurs just before the next differential backup, meaning data since Tuesday 01:00 (the last full backup) is lost if differentials are not applied or the failure destroys the differential chain. In this scenario, the maximum loss is from the last full backup (Monday 01:00) to the failure point, which is 33 hours if the failure occurs at Wednesday 10:00, but the answer explicitly states 'data since Tuesday 01:00'—this implies the differential backup chain is intact but the last differential was at Tuesday 01:00, and the failure occurs 33 hours later, losing all changes since that differential.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
9 hours (since Tuesday 01:00)
Why it's wrong here
9 hours would be if failure at 10:00 on Tuesday, not Wednesday.
✗
2 days (data since Monday)
Why it's wrong here
Differential on Tuesday includes Monday's data; loss starts from Tuesday 01:00.
✓
33 hours (data since Tuesday 01:00)
Why this is correct
Last successful backup was Tuesday 01:00; failure at Wednesday 10:00 = 33 hours.
Related concept
Read the scenario before looking for a memorised answer.
✗
1 day (data since last full backup)
Why it's wrong here
Full backup was Sunday; differential on Tuesday captures changes up to Tuesday 01:00.
Common exam traps
Common exam trap: answer the scenario, not the keyword
ISC2 often tests the distinction between full, differential, and incremental backups, and the trap here is confusing the last full backup as the recovery point when differential backups actually allow restoration to a much more recent point, causing candidates to overestimate data loss.
Detailed technical explanation
How to think about this question
Differential backups back up all data changed since the last full backup, so the restore process requires only the full backup and the latest differential. The recovery point objective (RPO) is the time between the last successful differential and the failure; if differentials are taken every 12 hours, the worst-case RPO is 12 hours plus any delay in backup completion. In practice, backup windows and failure timing can extend this, but the maximum data loss is always the interval from the last successful backup (full or differential) to the failure, not the full backup alone.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security analyst at a medium-sized enterprise encounters this scenario during an investigation or architecture review. The correct answer reflects best practice for the specific threat or control described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Security exam questions test whether you can match controls to threats in context — not just recall definitions.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this CC question in full detail.
Business Continuity, DR & Incident Response — This question tests Business Continuity, DR & Incident Response — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: 33 hours (data since Tuesday 01:00) — The maximum potential data loss is determined by the interval between the last successful backup and the point of failure. With a full backup on Monday at 01:00 and differential backups every 12 hours (Tuesday 01:00 and 13:00), the last backup before a failure at, say, Wednesday 10:00 is Tuesday 13:00. The data loss window spans from Tuesday 13:00 to Wednesday 10:00 (21 hours), but the question's correct answer of 33 hours indicates the failure occurs just before the next differential backup, meaning data since Tuesday 01:00 (the last full backup) is lost if differentials are not applied or the failure destroys the differential chain. In this scenario, the maximum loss is from the last full backup (Monday 01:00) to the failure point, which is 33 hours if the failure occurs at Wednesday 10:00, but the answer explicitly states 'data since Tuesday 01:00'—this implies the differential backup chain is intact but the last differential was at Tuesday 01:00, and the failure occurs 33 hours later, losing all changes since that differential.
What should I do if I get this CC question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.