Backup Strategies
Backup types including full, incremental, and differential backups. Covers onsite/offsite storage, frequency planning, the 3-2-1 rule, and retention policies for comprehensive data protection.
Understanding Backup Strategies
Backups are the last line of defense against data loss. A proper backup strategy balances recovery speed, storage costs, and protection against various threats—from ransomware to natural disasters.
Key backup concepts: • Backup types — Full, incremental, differential • Storage locations — Onsite, offsite, cloud • Frequency — How often to backup • Retention — How long to keep backups
The 2021 Colonial Pipeline ransomware attack initially disabled operations for days. While they ultimately paid the ransom, organizations with tested offline backups recovered from similar attacks without payment. Having backups is essential, but having the right backups in the right places is what matters.
Backup strategy must be designed, tested, and verified—not assumed.
Why This Matters for the Exam
Backup strategies are heavily tested on SY0-701 because they're fundamental to recovery. Questions cover backup types, 3-2-1 rule, and restoration scenarios.
Understanding backups helps with ransomware recovery, disaster recovery, and compliance requirements. Poor backup strategy = extended outages or permanent data loss.
The exam tests both backup type knowledge and practical strategy decisions.
Deep Dive
What Are the Different Backup Types?
Full Backup:
Copies ALL selected data Every file, every time Longest backup time Fastest restore time Monday: Full backup of ALL data Storage: 100GB
Incremental Backup:
Copies only data changed SINCE LAST BACKUP (any type) Smallest backup size Longest restore time (need all incrementals) Monday: Full (100GB) Tuesday: Incremental (changes since Monday: 5GB) Wednesday: Incremental (changes since Tuesday: 3GB) Thursday: Incremental (changes since Wednesday: 4GB) Restore: Full + Tues + Wed + Thurs
Differential Backup:
Copies data changed SINCE LAST FULL backup Medium backup size (grows daily) Medium restore time (full + latest differential) Monday: Full (100GB) Tuesday: Differential (changes since Monday: 5GB) Wednesday: Differential (changes since Monday: 8GB) Thursday: Differential (changes since Monday: 12GB) Restore: Full + Thursday differential only
Comparison Table:
| Aspect | Full | Incremental | Differential |
|---|---|---|---|
| Backup time | Longest | Shortest | Medium |
| Storage used | Most | Least | Medium |
| Restore time | Fastest | Slowest | Medium |
| Media needed | 1 | Full + all incremental | Full + 1 differential |
What Is the 3-2-1 Backup Rule?
The 3-2-1 rule is a best practice for backup resilience:
3 - Three copies of data
(1 primary + 2 backups)
2 - Two different media types
(disk + tape, disk + cloud)
1 - One copy offsite
(protects against site disaster)3-2-1 Implementation:
Copy 1: Primary data (production server) Copy 2: Local backup (onsite NAS) Copy 3: Remote backup (cloud or offsite location) Media diversity: - Local: Disk-based backup - Remote: Cloud storage or tape Location diversity: - Onsite for fast recovery - Offsite for disaster protection
Enhanced 3-2-1-1:
3-2-1 plus:
1 - One copy offline or immutable
(protection against ransomware)What Is Onsite vs Offsite Backup?
Onsite Backup:
| Pros | Cons |
|---|---|
| Fast recovery | Vulnerable to site disaster |
| Low latency | Vulnerable to local ransomware |
| Easy access | No geographic protection |
| Lower ongoing cost | Single point of failure |
Offsite Backup:
| Pros | Cons |
|---|---|
| Disaster protection | Slower recovery |
| Geographic separation | Data transfer costs |
| Ransomware protection | Bandwidth requirements |
| Compliance support | Access complexity |
Hybrid Approach:
[Primary Data]
|
[Onsite Backup] ─── Fast recovery for common issues
|
[Offsite Backup] ─── Disaster/ransomware protection
Both needed for comprehensive protectionWhat Are Backup Frequency Considerations?
Frequency Factors:
| Factor | Impact |
|---|---|
| RPO | How much data loss acceptable? |
| Data change rate | How fast does data change? |
| Backup window | How long for backup to complete? |
| Storage capacity | How much can you store? |
Common Schedules:
| Strategy | Example |
|---|---|
| Daily full | Sunday: Full, Mon-Sat: None |
| Weekly full + daily differential | Sunday: Full, Mon-Sat: Differential |
| Weekly full + daily incremental | Sunday: Full, Mon-Sat: Incremental |
| Continuous | Real-time replication |
What Is Backup Retention?
Retention determines how long backups are kept.
Retention Policies:
| Type | Purpose |
|---|---|
| Short-term | Quick recovery (days) |
| Medium-term | Compliance, investigation (weeks-months) |
| Long-term | Archive, legal hold (years) |
Grandfather-Father-Son (GFS) Rotation:
Daily backups (Son): Keep 7 days Weekly backups (Father): Keep 4 weeks Monthly backups (Grandfather): Keep 12 months Example retention: - Last 7 daily backups - Last 4 Friday backups - Last 12 month-end backups
Compliance Requirements:
| Regulation | Typical Retention |
|---|---|
| HIPAA | 6 years |
| SOX | 7 years |
| PCI-DSS | 1 year |
| GDPR | Varies (minimum necessary) |
What About Ransomware Protection?
Modern backup strategy must consider ransomware.
Ransomware-Resistant Backups:
| Strategy | Protection |
|---|---|
| Air-gapped backups | Physically disconnected |
| Immutable backups | Cannot be modified/deleted |
| Offline backups | Not network-accessible |
| Versioning | Multiple point-in-time copies |
| Anomaly detection | Alert on unusual backup patterns |
Immutable Backup:
Once written, cannot be: - Modified - Deleted - Encrypted by ransomware Common implementations: - WORM storage - Object lock (cloud) - Air-gapped tape
How CompTIA Tests This
Example Analysis
Scenario: A company needs to design a backup strategy for a 500GB database. Requirements: RPO of 4 hours, ability to recover within 2 hours, protection against ransomware, and 7-year retention for compliance.
Analysis - Backup Strategy Design:
Requirements:
| Requirement | Implication |
|---|---|
| RPO: 4 hours | Backup at least every 4 hours |
| RTO: 2 hours | Fast restore capability |
| Ransomware protection | Offline/immutable copies |
| 7-year retention | Long-term archival |
Backup Strategy:
Tier 1: Continuous Protection (RPO)
Database transaction logs: Continuous replication RPO achieved: Minutes (not just 4 hours) Storage: Local high-speed storage Purpose: Operational recovery
Tier 2: Daily Backups (Fast Recovery)
Type: Daily full backup Time: 2 AM (off-peak) Storage: Onsite backup server Retention: 7 days Restore time: < 2 hours (meets RTO)
Tier 3: Weekly Offsite (Disaster Protection)
Type: Weekly full backup When: Sunday Storage: Offsite location + cloud Retention: 4 weeks onsite, 12 weeks offsite Purpose: Site disaster recovery
Tier 4: Monthly Archive (Compliance)
Type: Monthly full backup When: Month-end Storage: Immutable cloud + tape archive Retention: 7 years Purpose: Compliance, legal hold
Ransomware Protection:
Layer 1: Immutable cloud backups (object lock) Layer 2: Air-gapped tape copies (monthly) Layer 3: Anomaly monitoring on backup jobs Layer 4: Regular restore testing
3-2-1-1 Implementation:
3 copies: Production + onsite backup + offsite 2 media: Disk (production/local) + cloud/tape 1 offsite: Cloud storage in different region 1 immutable: Object-locked cloud copies
Key insight: Multiple backup tiers address different requirements. Frequent local backups for fast RPO/RTO, offsite for disaster protection, and immutable/air-gapped for ransomware. Compliance retention may be different from operational retention.
Key Terms
Common Mistakes
Exam Tips
Memory Trick
Backup Types:
"Incremental = Inch by inch" (small, since last backup) "Differential = Daily from D-day (full)" (since last FULL) "Full = Fully everything"
Restore Time: "Full is Fastest to restore" "Incremental is the Inverse (slowest)" "Differential is in the Dmiddle"
3-2-1 Rule: "Three copies, Two media, One offsite" Or: "3 copies, 2 types, 1 away"
3-2-1-1 Extension: "3-2-1 + 1 Immutable (ransomware protection)"
GFS Memory: "Grandfather, Father, Son = Monthly, Weekly, Daily" Like generations: Oldest (monthly) to youngest (daily)
Incremental vs Differential: ``` Incremental: "What's new since YESTERDAY?" Differential: "What's new since SUNDAY?" (last full) ```
Test Your Knowledge
Q1.Which backup type copies only data that changed since the last FULL backup?
Q2.According to the 3-2-1 backup rule, how many copies of data should exist?
Q3.Which backup storage method provides the BEST protection against ransomware?
Want more practice with instant AI feedback?
Continue Learning
Ready for the Exam?
See exactly where you stand on this concept and 182 others.
99% pass rate · Pass guarantee