I85PREP
⌘ K
CCRTS study materials
CCRTS study resources

CCRTS: Backup, Replication, and Immutable Data Protection

CCRTS · Work through your exam, one topic at a time.

All guide sections

Backup, Replication, and Immutable Data Protection

Protect the recovery data itself

The exam tests whether you can design backup and replication that survive the same attack that destroys production. The baseline rule is 3-2-1-1-0: at least three copies, on two media types, one offsite, one immutable or offline, and zero unverified restores. Immutability means data cannot be altered or deleted during a retention window-object lock, WORM storage, or offline media. The window must exceed the attacker's likely dwell time and your detection gap.

Core rules

  • Backup types: full, incremental, differential, and synthetic full. Retention should follow a documented schedule, for example daily, weekly, monthly, and yearly, with legal holds where needed.
  • Encrypt backups in transit and at rest, but keep keys separate from the backup data and from production domain credentials. Losing keys is a recovery failure.
  • Immutable copies need a separate trust boundary: separate account, subscription, credentials, and management plane. MFA delete and delete protection reduce accidental or malicious destruction.
  • Replication is availability, not backup. Synchronous replication copies corruption and encryption quickly; asynchronous replication may still be overwritten. Snapshots on the same array or with the same admin account are not a ransomware defense.
  • Verify restores: file-level, application-level, and full-system. Check catalog integrity, bootability, data consistency, and restore time against RTO. Record evidence.

Worked example

A retailer's backup server is domain-joined and uses the same administrator account as production. Ransomware encrypts both. The redesign puts backups in an isolated account with object lock for 45 days, uses a separate backup identity with MFA, keeps one offline copy, and tests a monthly restore of the order database. The 45-day lock is chosen because detection historically took 21 days and dwell time could be weeks. The restore test measures both data integrity and time to meet the four-hour RTO.

Traps

Do not claim 3-2-1 compliance when all copies are online and reachable. Do not treat snapshots or replication as backups. Do not store encryption keys with the backups. Do not skip restore tests or test only a single file. Do not set immutability shorter than the detection and retention requirement.