3.4 - Resilience and recovery
Security+ SY0-701 objective 3.4 covers designing systems to survive failure and recover fast. RAID 5 uses striping with parity so an array keeps running if one drive fails. Backup types differ: a differential backs up everything changed since the last full backup, while an incremental backs up only changes since the last backup of any kind. Recovery objectives drive site choice - a system with a 5-minute RPO and 15-minute RTO needs near-real-time replication to a hot site, whereas warm and cold sites suit looser targets. WORM (write-once, read-many) storage lets auditors read records for years while guaranteeing no one alters them. You should also know high availability, load balancing and testing plans. Expect scenario questions that give a fault-tolerance or recovery target and ask which resilience design meets it.
One-drive-failure survival, parity = RAID 5. Changes since last FULL = differential; since last backup of any kind = incremental. Tight RPO/RTO = hot site (near-real-time replication). Read-only records for years = WORM.
Practice questions
1. The 3-2-1 backup rule specifies:
- 3 admins, 2 servers, 1 backup site
- Back up the data three times daily
- 3 copies, 2 media, 1 off-site (correct answer)
- Retain all backups for 321 days
3-2-1: keep 3 copies, on 2 different media, with 1 copy off-site/offline — protecting against device, site and ransomware loss. Test restores too.
2. Which device protects equipment by supplying battery power instantly during a brief outage for a safe shutdown?
- A diesel backup generator set
- An uninterruptible power supply (correct answer)
- A surge protector power strip
- A managed power distribution unit
A UPS supplies instant battery power to bridge short outages and allow safe shutdown; generators handle longer outages but start after a delay.
3. A tool that alerts when critical system files are unexpectedly modified provides:
- Full-disk encryption
- File integrity monitoring (correct answer)
- Network load balancing
- Automatic patch rollout
File Integrity Monitoring (FIM) baselines files and alerts on unexpected changes — useful for detecting tampering, malware or unauthorized configuration edits.
4. A server needs a redundant array that keeps running if ONE drive fails while using capacity efficiently. Which RAID fits?
- RAID 0 (striping only)
- RAID 5 (parity) (correct answer)
- JBOD (no redundancy)
- A single large disk
RAID 5 stripes with distributed parity, tolerating one drive failure with efficient capacity use. RAID 0 has no redundancy; JBOD/single disk aren't fault-tolerant.
5. A team makes a full backup weekly and each day backs up only what changed since the LAST full. This daily type is:
- An incremental backup
- A differential backup (correct answer)
- A full backup
- A snapshot backup
Differential backs up all changes since the last FULL backup, so restore needs only the full plus the latest differential — faster restore, larger daily sets than incremental.
6. A company wants its DR site far enough that a regional disaster won't hit both locations. This principle is:
- Vertical server scaling
- Geographic dispersion (correct answer)
- Cloud vendor lock-in
- Dedicated single-tenancy
Geographic dispersion places backups/DR sites in different regions so one regional event (flood, quake, power) can't take out both. Balance latency, cost and sovereignty.