(ISC)2 Certified in Cybersecurity Practice Exam

Which backup type consists of all data changed since the last full or incremental backup?

1. Differential Backup

2. Incremental Backup

3. Full Backup

4. Image Backup

The correct answer is: Incremental Backup

The option identified as the correct answer refers to a differential backup. This type of backup is designed to capture all the data that has changed since the last full backup was performed. Its primary characteristic is that each differential backup includes all changes made after that last full backup, which means it accumulates data until the next full backup occurs. Differential backups provide a balance between the speed of restoration and the amount of storage space used, as it is typically smaller than a full backup but larger than an incremental backup. When restoring data, only the last full backup and the most recent differential backup are needed, which simplifies the recovery process. In contrast, an incremental backup only saves changes made since the most recent backup of any kind (whether full or incremental), meaning each incremental backup is smaller and faster to create but can complicate recovery, as multiple backups would need to be restored. Full backups contain all selected data and require the most storage space and time to complete. Image backups capture the entire state of a system, including the operating system, applications, and data, rather than just data changes. Understanding these distinctions helps in making informed decisions regarding backup strategies, recovery time objectives, and storage efficiency.