(ISC)2 Certified in Cybersecurity Practice Exam

Which backup type includes only files that have changed since the most recent full or incremental backup?

1. Full backup

2. Incremental backup

3. Differential backup

4. Mirror backup

The correct answer is: Incremental backup

The correct option is based on the nature of incremental backups, which are specifically designed to enhance backup efficiency and reduce storage requirements. An incremental backup captures only the data that has changed since the last backup—whether that was a full backup or another incremental backup. This means that if you perform a full backup first, subsequent incremental backups will only include the files that have been added or modified since that last point in time. This approach allows organizations to save time and resources because it minimizes the amount of data that needs to be copied and stored after the initial full backup is completed. As a result, recovery operations can be quicker and more efficient, since only the last full backup and the most recent incremental backup must be restored to get the system back to its latest state. In contrast, a full backup involves copying all data every time it is executed, regardless of any changes. A differential backup includes all changes made since the last full backup, meaning it grows larger over time until the next full backup is completed. A mirror backup creates an exact copy of the data in its current state, not just the changes since the last backup, which does not fit the definition of capturing only changed files since the recent full or incremental backup.