ISC2 CC Business Continuity, DR & Incident Response Practice Question
Which TWO are best practices for managing backup media?
⚠ Common exam trap
ISC2 often tests the 3-2-1 backup rule (three copies, two different media, one offsite) to trick candidates into thinking that keeping backups on the same server is acceptable for convenience, when it actually violates the core principle of redundancy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Encrypt backup data
Encrypting backup data ensures confidentiality and integrity during transit and at rest, protecting against unauthorized access if media is lost or stolen. This is a critical best practice for compliance with standards like GDPR or HIPAA, and aligns with the principle of defense in depth. Without encryption, backup media becomes a significant security vulnerability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Encrypt backup data
Why this is correct
Encryption protects sensitive data from unauthorized access.
- ✗
Keep backups on the same server for easy access
Why it's wrong here
Storing backups on the same server risks total loss.
- ✓
Store backups in a separate physical location
Why this is correct
Off-site storage protects against site-wide disasters.
- ✗
Use only tape media
Why it's wrong here
Using only tape is overly restrictive; multiple media types are acceptable.
- ✗
Test backups annually
Why it's wrong here
Annual testing is too infrequent; quarterly or more frequent testing is recommended.
Go deeper
Related to this question
Learn chapter
Introduction to Security Principles
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
Key term
Defense in depth
Defense in depth is a cybersecurity strategy that uses multiple layers of security controls to protect information and systems, so if one layer fails, another layer is already in place to stop the attack.
About these practice questions
This CC question is part of Courseiva's 976-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.