ISC2 CC Practice Question: Business Continuity, Disaster Recovery, and Incident Response
Which backup method copies all data that has changed since the last full backup, regardless of subsequent incremental or differential backups?
⚠ Common exam trap
The trap is the wording 'since the last full backup' — candidates often pick Incremental, but incrementals reset their baseline after every backup, while differentials always reference the last full.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Differential backup
A differential backup captures all data changed since the last full backup, so each successive differential grows larger until the next full backup resets the baseline. This differs from an incremental backup, which only captures changes since the last backup of any type. The key characteristic in the question — 'regardless of subsequent incremental or differential backups' — matches the differential model, where the reference point remains the last full backup.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Full backup
Why it's wrong here
A full backup copies every file regardless of change state, so it captures far more than the changed-since-last-full set. It is tempting because it is the baseline all other methods reference, and would be correct when a complete, self-contained restore point is required.
- ✗
Synthetic full backup
Why it's wrong here
A synthetic full constructs a new full backup from the previous full plus subsequent incrementals, but it captures only the data those incrementals already contained, not everything changed since the last full. A differential backup copies all changes since the last full. Synthetic fulls suit reducing backup windows while producing full restore points.
- ✓
Differential backup
Why this is correct
A differential backup captures every change made since the last full backup, accumulating data across days regardless of intervening backups. Incremental backups instead capture only changes since the previous backup of any type, so they fail the stem's "since the last full backup" constraint.
- ✗
Incremental backup
Why it's wrong here
Incremental backup copies only data changed since the most recent backup of any type, so a later incremental excludes changes already captured by an intervening one. It is tempting because it minimises backup volume, and would be correct when each successive backup builds on the previous one.
Go deeper
Related to this question
About these practice questions
This CC question is part of Courseiva's 989-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.