Business Continuity, DR & Incident Response →mediumMultiple Select

ISC2 CC Business Continuity, DR & Incident Response Practice Question

Which TWO are best practices for managing backup media?

⚠ Common exam trap

ISC2 often tests the 3-2-1 backup rule (three copies, two different media, one offsite) to trick candidates into thinking that keeping backups on the same server is acceptable for convenience, when it actually violates the core principle of redundancy.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Encrypt backup data

Option A (Encrypt backup data) is correct because backups contain sensitive data at rest, and encryption protects confidentiality if media is lost, stolen, or accessed by unauthorized parties, satisfying compliance and security best practices. Option C (Store backups in a separate physical location) is correct because offsite storage ensures survivability against site-wide disasters such as fire, flood, or theft, enabling recovery even if the primary site is destroyed. Option B is wrong because keeping backups only on the same server leaves them vulnerable to the same failure, ransomware, or disaster that affects the production system. Option D is wrong because best practice is a tiered or diversified media strategy (disk, tape, cloud) based on RPO/RTO and cost, not reliance on a single media type. Option E is wrong because backups should be tested regularly — ideally after each backup cycle or at least quarterly — not just annually, since untested backups may be unusable when needed.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Encrypt backup data
Why this is correct
Encrypting backup data protects the confidentiality of information at rest on removable media, which is the specific control needed when tapes or drives leave a secured data centre. It satisfies the stem's media-handling constraint by ensuring that theft or loss of physical media does not expose the backed-up contents.
✗
Keep backups on the same server for easy access
Why it's wrong here
Same-server storage means the backup is destroyed with the primary data during fire, theft or ransomware, defeating the purpose of a separate copy. Local retention is acceptable only as a fast-restore cache alongside offsite copies.
✓
Store backups in a separate physical location
Why this is correct
Storing backups in a separate physical location satisfies the geographic separation constraint, ensuring a single disaster cannot destroy both production data and its copies. This off-site practice protects against site-wide events such as fire, flood or theft, preserving recoverability when local media is lost.
✗
Use only tape media
Why it's wrong here
Tape alone cannot meet recovery time objectives for frequent restores and requires drives, software and offsite rotation. Tape is a valid archival or air-gapped tier, but best practice combines it with disk or cloud copies.
✗
Test backups annually
Why it's wrong here
Annual testing leaves recovery unverified for up to twelve months, so media degradation or corrupted restore procedures go undetected between checks. Testing is genuinely valuable after hardware changes or before audits, but recognised practice requires periodic restore verification at intervals matched to the backup frequency and retention period, not a fixed yearly cycle.

Go deeper

ISC2 CC Business Continuity, DR & Incident Response Practice Question

Why each option matters

Option-by-option breakdown

Related to this question