ISC2 CC Practice Question: Business Continuity, Disaster Recovery, and Incident Response
Which type of backup copies all data that has changed since the last full backup, regardless of any subsequent incremental or differential backups?
⚠ Common exam trap
CC often tests the confusion between incremental and differential backups, particularly the point of reference (last backup vs. last full backup) and the resulting restore complexity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Differential backup
A differential backup copies all data that has changed since the last full backup, regardless of any subsequent incremental or differential backups. This means each differential backup includes all changes since the last full backup, growing in size over time. Therefore, differential backup is the correct answer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Full backup
Why it's wrong here
A full backup copies all selected data regardless of change status, not only data changed since the previous full backup. It is tempting as the baseline every other backup type references, but it captures everything rather than the delta since that baseline.
- ✓
Differential backup
Why this is correct
A differential backup captures every block changed since the last full backup, so each successive run accumulates all modifications regardless of earlier differentials. This satisfies the stem's constraint of copying changes since the last full backup, unlike incremental backups, which capture only changes since the previous backup of any type.
- ✗
Incremental backup
Why it's wrong here
An incremental backup copies only data changed since the last backup of any type, so subsequent incrementals reset the delta point. It is tempting because it also captures changes, but a differential backup is the type that always measures from the last full backup.
- ✗
Synthetic full backup
Why it's wrong here
A synthetic full backup constructs a full backup from existing full plus incremental or differential backups, so it does not itself copy data changed since the last full backup. It is tempting because it produces a full-image equivalent, but that result is assembled, not freshly captured.
About these practice questions
Courseiva writes every CC question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.