Security+ ransomware-resilient backups
A backup should remain usable when production systems or credentials are compromised. Offline or appropriately isolated copies reduce attacker reach, and immutable retention can prevent certain modifications or deletions. Independent copies in separate failure domains also reduce physical-loss exposure. Recovery testing is essential: a protected copy that cannot be restored within business requirements is an incomplete recovery plan.
How to read the scenario
RAID is an availability mechanism, not an independent recovery history. Deletion or encryption can affect every mirrored member.
Identify the required outcome, the evidence already provided, and the limits on the technician’s action. Compare every option against those details before deciding. Record why the closest alternative does not meet the stated need.
Original practice example
A company needs ransomware-resilient recovery copies. Which TWO measures provide complementary protection? Select TWO.
- Treat a RAID mirror as the only backup.
- Regularly test restoration.
- Keep every copy writable with the production administrator account.
- Maintain an offline or isolated recovery copy.
Show the answer and explanation
Regularly test restoration.; Maintain an offline or isolated recovery copy.
Isolation reduces attacker reach, while restore tests check usability. A writable mirror alone does not protect against malicious deletion or encryption.
Study questions
Which objective does this guide support?
SY0-701, objective 3.4. This independent guide supports original practice and does not replace the full official objectives.
What should I watch for in a scenario?
RAID is an availability mechanism, not an independent recovery history. Deletion or encryption can affect every mirrored member.
Source and version
CompTIA official SY0-701 objectives, objective 3.4. Verified November 5, 2026. This guide targets SY0-701. SY0-801 is expected around November 17, 2026 and is outside this edition.