Backups — Tricks

Trick 1 On-Site = Fast. Off-Site = Survives Disasters. You Need Both.

The exam will describe a backup scenario and ask which type it is, or present a disaster and ask which backup would survive it. The discriminator is always location and what happens in a site-level disaster. On-site is fast but dies with the building; off-site survives the disaster but is slower to restore from.

Pattern Recognition

"No internet link required" / "immediately available" / "same building"

→ On-site backup

"Shipped to a third-party storage facility" / "transferred over WAN" / "different location"

→ Off-site backup

"Fire destroys the data center — which backup survives?"

→ Off-site backup (same-building on-site copies are destroyed with the building)

"Which backup provides the fastest restoration of a deleted file?"

→ On-site backup (no WAN; LAN speeds; immediately available)

"The organization uses both on-site and off-site backups" — why?

→ More copies + more options: on-site for speed, off-site for disaster resilience

Memory anchor: On-site = speed. Off-site = survival. A flood that destroys the server room also destroys the on-site backup sitting next to it.

Trick 2 Replication ≠ Backup. Ransomware Proves the Difference Every Time.

The exam loves testing whether students understand that replication and backup are different tools for different threats. Replication is real-time and excellent for infrastructure failures. It is dangerous against ransomware and accidental deletion because it propagates those changes immediately. This is the single most important backup distinction on the exam.

Pattern Recognition

"Near-real-time" / "continuously synchronized" / "changes within seconds"

→ Replication (not periodic backup)

"Ransomware encrypted files — replication site also has encrypted files" — why?

→ Replication propagated the encrypted files and overwrote the good copies

"Which method provides recovery from ransomware when replication has failed?"

→ Periodic backup — point-in-time copy taken before the ransomware struck

"Replication is ideal for which DR site type?"

→ Hot site — continuously receives current data; can activate immediately

Memory anchor: Replication copies everything — the good and the bad. Ransomware is a change. Replication copies changes. Result: replicated ransomware.

Trick 3 Snapshot After the First = Incremental (Changes Only, Not the Full System)

The exam will ask about snapshots and their storage efficiency or restoration process. Remember: only the first snapshot is a full copy. Every snapshot after that captures only what changed since the previous snapshot. This makes daily snapshots of large VMs practical — but it means restoration to a specific day requires applying multiple snapshots in sequence.

Pattern Recognition

"Monday snapshot = 100 GB / Tuesday snapshot = 40 GB" — why different sizes?

→ Tuesday is incremental — only the 40 GB that changed since Monday is stored

"Which backup method is most common for virtual machines and cloud infrastructure?"

→ Snapshot — instant, click-once, incremental after the first

"An admin wants to quickly undo a bad OS patch on a VM" — best approach?

→ Revert to a snapshot taken just before the patch (minutes to revert)

"What must be preserved for all incremental snapshots to be usable?"

→ The initial full snapshot — without it, incremental deltas cannot be applied

Memory anchor: First snapshot = full copy. Every snapshot after = only what changed. Day 1 is the foundation; all other days build on it.

Trick 4 Backup Encryption: Stolen Media = No Breach. Missing Key = No Recovery.

Backup encryption questions test two things: why it is necessary and what its critical dependency is. The why: backup media is a complete copy of organizational data — easily stolen, easily read without encryption. The dependency: the recovery key must be stored separately from the media and must be accessible when needed. Both halves of this are frequently tested.

Pattern Recognition

"Backup tapes were stolen — data exposed" — what was missing?

→ Backup encryption — stolen ciphertext is unreadable without the key

"Cloud backups — encryption is practically mandatory" — why?

→ Data stored in third-party environment; no control over who can access it; encryption ensures confidentiality regardless of provider access

"Recovery key stored on the same tape it encrypts" — what is the problem?

→ Anyone who steals the tape also has the key — encryption provides no protection

"Encrypted backup — production server destroyed by ransomware — cannot restore" — why?

→ Recovery key was stored only on the destroyed server — key is gone; backup is permanently inaccessible

Memory anchor: Encrypted backup + no key = expensive unusable storage. The key and the backup must be independently resilient.

Trick 5 Journaling: Write Journal FIRST → Write Storage SECOND. Power Fails = Safe Either Way.

Journaling questions test the sequence of operations and the outcome of each failure point. The sequence is always: journal entry first, then storage write, then clear the journal entry. Power failure at any point is handled safely — either nothing was written yet, or the journal allows replay at startup. The exam tests which failure produces which outcome.

Pattern Recognition

"Power fails DURING journal write (before storage write begins)"

→ Storage is clean and untouched; no corruption; no backup needed

"Power fails DURING storage write (journal was already written)"

→ Journal allows system to replay and complete the write at startup; no backup needed

"Database corrupted after power failure — what technology prevents this?"

→ Journaling (write-ahead logging)

"What journaling protects against" — exam phrasing

→ Corruption from interrupted write operations (power failure, system crash mid-write)

Memory anchor: Journal = intent log. Storage = the actual data. Write your intent before acting. If you're interrupted, your intent survives and can be completed later.

Practice Scenarios — Apply the Tricks

Scenario A: An organization performs nightly backups to a NAS device in the server room and also ships monthly tape backups to a storage facility 300 miles away. A fire destroys the server room on a Wednesday afternoon. What backup options does the organization have, and what data loss should it expect?

Scenario B: A VM administrator runs daily snapshots of a production application server. Monday's snapshot was 80 GB. Tuesday's snapshot was 15 GB. Wednesday's snapshot was 8 GB. The administrator wants to restore the VM to Tuesday's state. What must they do?

Scenario C: A company's file server is hit by ransomware at 2:30 PM Tuesday. They have both replication (continuous) and nightly backups (runs at 1:00 AM). Both the primary site and the replicated site now have encrypted files. What is their best recovery option and how much data will they lose?

Backups — Exam Tricks