ISC2 CC Business Continuity, DR & Incident Response Practice Question
Which TWO are true about a differential backup? (Select two.)
⚠ Common exam trap
ISC2 often tests the distinction between differential and incremental backups by making candidates confuse 'changed since last full' (differential) with 'changed since last backup of any type' (incremental), and by implying that differential backups reset the archive bit when they do not.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It requires a full backup to be restored first
Option B is correct because a differential backup only contains data changed since the last full backup, so restoring requires the original full backup plus the most recent differential backup to reconstruct the complete data set. Option C is correct because a differential backup by definition copies all files that have changed since the last full backup, not since the last incremental or differential backup. Option A is incorrect because copying files changed since the last backup of any type describes an incremental backup, not a differential backup. Option D is incorrect because resetting the archive bit is characteristic of incremental backups (and some full backups), whereas differential backups do not reset the archive bit, which is why each successive differential grows larger. Option E is incorrect because a differential restore requires two restore operations (full plus differential) and is therefore not faster than restoring a single full backup.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It copies files changed since the last backup of any type
Why it's wrong here
A differential backup copies files changed since the last full backup, not since the last backup of any type; that incremental definition is the axis of difference. It is tempting because both capture only changed data, but incrementals chain from the previous incremental, which is why restore needs the full plus every increment.
- ✓
It requires a full backup to be restored first
Why this is correct
A differential backup captures only changes since the last full backup, so it cannot be applied alone. Restoring requires the originating full backup first, then the latest differential, which is why this dependency is a defining characteristic.
- ✓
It copies files changed since the last full backup
Why this is correct
A differential backup records every file modified since the most recent full backup, regardless of how many differentials have run since. This cumulative behaviour distinguishes it from incremental backups, which capture only changes since the previous backup of any type.
- ✗
It resets the archive bit on backed-up files
Why it's wrong here
Resetting the archive bit is the incremental backup's behaviour; a differential leaves the archive bit set so subsequent differentials keep capturing the same changes. It is tempting because both backup types read the archive bit, but only incremental clears it, which is the concrete mechanism distinguishing them.
- ✗
It is faster to restore than a full backup
Why it's wrong here
A differential restore requires the last full plus the latest differential, so it is not faster than restoring a full backup alone; it is faster than incremental restore, which needs every increment. It is tempting because fewer sets than incremental are needed, but the full backup remains the baseline.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CC question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.