(ISC)2 Certified in Cybersecurity Practice Exam

If Joe performs full backups every Sunday and differential backups every weekday, which backups must he restore after a system failure on Friday?

1. Thursday's incremental and Sunday's full backup

2. Weekday backups and Sunday's full backup

3. Sunday's full backup and Thursday's differential backup

4. Just the most recent backup

The correct answer is: Sunday's full backup and Thursday's differential backup

To understand the correct answer, it's important to consider how full and differential backups function. A full backup captures all data at a specific point in time, while a differential backup captures changes made since the last full backup. In Joe's case, he performs a full backup every Sunday, which provides a complete picture of the system at that time. Every weekday, he conducts differential backups, which track what has changed since the last full backup—this means they include all changes made up to the last Sunday. If a system failure occurs on Friday, Joe would need to restore the most recent full backup from Sunday, which represents the state of the data at that point. Then, to bring the system up to date with the changes made since that last full backup, he would only need to restore the most recent differential backup, which in this case would be Thursday's differential backup. This backup will include all changes from the time of the last full backup (the previous Sunday) until Thursday. Restoring just the most recent backup would not work here, as it does not account for the full backup necessary to establish a complete data state. Therefore, the full backup from Sunday must be restored alongside the differential backup from Thursday to ensure the system is accurate and complete