IT PATH
My Path

Backup and Disaster Recovery

Design backup strategies and recovery plans that meet stated objectives and survive ransomware.

Certification
CompTIA Server+
Recommended study time
5h 35m
Status
Not started

Recommended study time

About 5h 35m in total, measured from the material on this page. At your session length of 45 minutes that is 8 sittings.

  • Read the lesson23 min

    About 3,054 words at a careful technical reading pace.

  • Second pass with notes14 min

    Re-read the harder parts and write your own notes.

  • Recall from memory12 min

    2 written recall questions.

  • Practice decision12 min

    One applied decision with feedback.

  • Teach it back20 min

    Write the topic in your own words.

  • Real-world scenario15 min

    Read the situation and justify your decision in writing.

  • Hands-on practice2h 40m

    Labs, commands and configuration until you can do it unaided.

  • Spaced review1h 20m

    4 short review sessions spread over the following weeks.

Learning objectives

  • Apply RPO and RTO to select appropriate backup and replication approaches.
  • Design retention and isolation that resists ransomware and accidental deletion.
  • Plan and evidence restore testing rather than assuming recoverability.

Start here

About 8 minutes of reading, in 10 short parts.

A backup that has never been tested is a hope, not a plan. Real backup and disaster recovery work starts by agreeing exactly how much data loss and downtime the business can tolerate, then building and proving a process that meets those numbers, including surviving an attacker who specifically targets backups.

Where you meet it: Someone requests a file restore from three months ago and discovers the backup job has been silently failing since last quarter.

The lesson, part by part

Open one part at a time. Each part stands on its own, so you can stop and come back.

A backup is like a spare key hidden somewhere safe in case you lock yourself out. But a spare key you have never tried in the lock might be the wrong key, or the lock might have been changed since you hid it, and you will not find that out until the exact moment you desperately need it to work. Testing a backup by actually restoring from it occasionally is the only way to know the spare key really opens the door.

Disaster recovery planning is the wider version of this idea: not just 'can I get this one file back', but 'if the whole building burned down, in what order would I rebuild everything, and how long would each piece take'. Writing that plan down before the fire happens is what makes the difference between an organised recovery and everyone standing around arguing about what to do first while customers are affected.

Key ideas

If you remember nothing else from this topic, remember these.

  • Recovery Point Objective defines how much data loss, measured in time, is acceptable, while Recovery Time Objective defines how quickly service must be restored, and the two drive completely different design decisions.
  • Full, incremental, and differential backups trade backup speed and storage against restore complexity and time.
  • The 3-2-1 backup rule, three copies of data on two different media types with one copy offsite, remains the baseline expectation for resilient backup design.
  • A backup that has never been tested with an actual restore is an unverified assumption, not a working safety net.
  • Disaster recovery planning covers far more than data, including where staff will work, how communication happens, and in what order systems come back online.
  • Ransomware specifically targets backups that are online and writable, which is why offline, immutable, or air-gapped copies are now treated as essential rather than optional.

Designing a backup strategy that survives a ransomware incident

A worked example, step by step.

A company previously relying only on nightly backups to an always-connected network share discovers that ransomware encrypted both production data and the backup share in the same incident.

  1. 01Assess the failureThe postmortem shows the backup share was mapped and writable from the same network the ransomware spread through, so backups were encrypted alongside production data.
  2. 02Define RPO and RTOBusiness stakeholders agree an RPO of 4 hours and an RTO of 8 hours is acceptable for the affected systems, driving the new backup frequency and infrastructure choices.
  3. 03Redesign the backup topologyA new backup target is configured as an isolated, non-domain-joined system that only accepts inbound connections during a scheduled backup window and is otherwise unreachable.
  4. 04Add immutabilityThe backup storage is configured with object lock so written backup files cannot be modified or deleted for a defined retention period, even by an administrator account.
  5. 05Increase backup frequencyIncremental backups are scheduled every four hours to meet the new RPO, with a weekly full backup as the base.
  6. 06Add an offsite copyA copy of backup data is replicated to a separate cloud region, satisfying the offsite requirement of the 3-2-1 rule.
  7. 07Test the restoreA tabletop restore of a sample database from the immutable backup completes successfully within the 8 hour RTO target.
  8. 08OutcomeThe new topology ensures a future ransomware event cannot reach or modify backup data, and the tested restore time meets business requirements.

Outcome: Isolated, immutable, offsite backups plus a proven restore process closed the gap that let a single incident destroy both production and backup data.

Backup and disaster recovery reference

Worth keeping at hand while you work.

Recovery Point Objective (RPO)
Maximum acceptable amount of data loss, measured as time since the last good backup.
Recovery Time Objective (RTO)
Maximum acceptable time to restore service after a disruption.
Full backup
Copies all selected data every time; slowest to run, fastest and simplest to restore.
Incremental backup
Copies only data changed since the last backup of any type; fastest to run, requires the full chain to restore.
Differential backup
Copies data changed since the last full backup; faster restore than incremental, larger than incremental over time.
3-2-1 rule
Three copies of data, on two different media types, with one copy offsite.
Immutable backup
Storage configured so written data cannot be altered or deleted for a set retention period.
Air-gapped backup
A copy physically or logically disconnected from the production network, unreachable by network-based attacks.
Hot site
A fully equipped alternate site that can take over operations almost immediately.
Warm site
A partially equipped alternate site requiring some setup time before taking over operations.
Cold site
A location with basic infrastructure but no ready systems, requiring significant time to become operational.
Restore testing
Regularly verifying that backups can actually be restored, not just that the backup job reports success.

Common misunderstandings

What most beginners get wrong here.

  • A backup job that completes without error means the data can definitely be restored.

    Only an actual test restore confirms recoverability; a successful backup job only confirms the copy operation completed.

  • Keeping backups on the same network as production is fine as long as they are encrypted.

    Ransomware and other network-based attacks can still reach and destroy backups that remain online and writable from the production network.

  • Incremental backups are always the best choice because they are fastest to create.

    They require the full chain of backups since the last full to restore, so a single corrupted increment can break the entire restore.

  • RPO and RTO measure the same thing.

    RPO measures acceptable data loss in time, while RTO measures acceptable downtime before service is restored; they drive different design decisions.

  • A hot site and a cold site provide the same level of readiness, just at different costs.

    A hot site is ready to take over almost immediately, while a cold site provides only basic infrastructure and needs significant setup time before use.

Exam traps

How the question writers try to catch you out.

  • Questions describing acceptable data loss in hours are asking about RPO; questions describing acceptable downtime are asking about RTO, and the exam expects you to distinguish them precisely.
  • A scenario where ransomware also destroyed backups is testing recognition of the need for offline, immutable, or air-gapped backup copies.
  • Differential versus incremental restore complexity is a frequently tested distinction, especially regarding how many backup sets are needed to restore.
  • Hot, warm, and cold site definitions are tested by readiness level and cost tradeoff, not just by name recognition.
  • A question describing a successful nightly backup job followed by a failed restore is testing the concept that backups must be tested, not just scheduled.

Check yourself

Answer in your head first, then reveal. This is not scored.

  • What is the difference between RPO and RTO?

  • Why did a network-connected backup share fail to protect data during a ransomware incident?

  • What does the 3-2-1 backup rule specify?

  • What is required to restore data from a chain of incremental backups?

  • Why is restore testing considered essential rather than optional?

Quick reference

A condensed summary of the lesson above, for revision.

What It Is

Recovery point objective is the tolerable data loss; recovery time objective is the tolerable downtime. Backup types include full, incremental, and differential, with strategies such as 3-2-1: three copies, two media types, one off-site. Immutable or air-gapped copies resist encryption and deletion. Disaster recovery extends this to site loss, with defined recovery order and dependencies.

Why It Matters

Ransomware deliberately targets backup infrastructure. A backup on an always-connected share with domain credentials is often encrypted alongside production, which is why isolation and immutability now matter as much as schedule.

How It Works

  • Backup jobs capture data on a schedule and write to local, off-site, or object storage.
  • Retention policies expire old copies while immutability locks them until expiry.
  • Recovery restores data and services in dependency order, verified against acceptance criteria.

Where You See It

  • File servers, databases, virtual machines, SaaS platforms, and regulatory retention programmes.

Key Terms

RPO
Maximum acceptable data loss measured in time.
RTO
Maximum acceptable time to restore service.
Immutable backup
A copy that cannot be modified or deleted before its retention expires.
Air gap
Physical or logical isolation from production networks and credentials.
Runbook
The documented recovery procedure and order.

Examples

  • An hourly snapshot with nightly off-site copy gives a one-hour RPO on site and one day off site.
  • Restoring a domain controller requires directory-aware procedures, not a plain file restore.

Common Problems

  • Untested restores
  • Backups reachable with production credentials
  • Insufficient retention
  • Missed workloads
  • Slow restores that miss RTO

How It Fails

  • Ransomware encrypts backups stored on a mapped share with the same credentials.
  • A restore that takes 40 hours cannot satisfy a four-hour RTO regardless of data completeness.
  • New workloads deployed after the backup policy was written are silently unprotected.

How to Troubleshoot

  1. Compare actual restore times against the documented RTO.
  2. Verify job success and content, not just the absence of errors.
  3. Reconcile protected systems against the current asset inventory.

Practical Knowledge

  • Use separate credentials and isolated storage for backup infrastructure.
  • Record restore test evidence with dates; auditors and insurers ask for it.

Exam Coverage

  • Backup types and rotation
  • RPO, RTO, and DR planning
  • Recovery testing and validation

Interview Questions

  • Why is replication not a backup?
  • How would you prove your backups would survive ransomware?

Watch and read

Verified official and reputable sources for this topic. Links open in a new tab.

Video training

  • Professor Messer video channel — general CompTIA training (no dedicated CompTIA Server+ course)

    Professor Messer

    Video
    Free
    Watch

Lesson notes and bookmark

Notes and bookmarks for this lesson, saved with everything else you have marked.

No notes on this item yet.

Learning progress

0% across six evidence areas. Reading alone does not change progress.

Understanding0%
Recall0%
Application0%
Practical ability0%
Troubleshooting0%
Retention0%

Prerequisites

Next steps

  1. 01Write the RPO and RTO for your three most critical systems.
  2. 02Perform and document one full restore test of a real workload.