easyMultiple Choice
SSCP Practice Question: A company's backup strategy includes weekly full…
A company's backup strategy includes weekly full backups and daily differential backups. A ransomware attack occurred on Wednesday, corrupting data. The last full backup was Sunday. Which backup set should be restored first?
⚠ Common exam trap
Many candidates confuse differential backups with incremental backups, mistakenly thinking they need to restore all differentials in order, or they try to restore the most recent differential without the full backup first.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sunday full backup
The correct restoration order is to first restore the Sunday full backup, because differential backups contain all changes since the last full backup. Without the full backup as a base, the differential backups cannot be applied. After restoring the full backup, you would then apply the most recent differential backup (Wednesday) to bring the data to the point just before the attack.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Wednesday differential backup
Why it's wrong here
Wednesday's differential was captured after the corruption began, so restoring it would reinstate encrypted or damaged data. Differentials are tempting because they are the most recent capture, but the correct first restore is Sunday's full backup, then Tuesday's differential, since each differential contains everything changed since that full.
- ✓
Sunday full backup
Why this is correct
Differential backups capture everything changed since the last full backup, so restoration must begin with that full backup as the base. Sunday's full backup is the correct starting point; Tuesday's differential is then applied on top to reach Wednesday's state.
- ✗
Monday differential backup
Why it's wrong here
Monday's differential cannot be applied before the Sunday full backup, since a differential contains only changes since that full. It is tempting as the earliest intact differential, but restore order is fixed: full first, then the latest differential, which here is Tuesday's, not Monday's.
- ✗
Tuesday differential backup
Why it's wrong here
Tuesday's differential is not restored first; the full backup from Sunday must be laid down before any differential can be applied. Differentials are tempting because they are the newest intact data, but they only hold changes since the last full, so they are useless without that full as the base.
Go deeper
Related to this question
About these practice questions
One of 971 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.