Business Continuity and Backup Awareness
This domain tests the language of continuity and recovery, how backup schemes differ, and what an ordinary employee is expected to do when a plan is activated. Items frequently ask you to compare a stated recovery objective with a stated capability.
The documents and the numbers
A business impact analysis identifies critical processes and their dependencies. The business continuity plan keeps essential functions running during disruption; the disaster recovery plan restores technology and data; incident response handles the event itself. Recovery time objective (RTO) is the maximum acceptable downtime. Recovery point objective (RPO) is the maximum acceptable data loss measured in time. Maximum tolerable downtime is the absolute limit before serious harm.
Backup schemes
- Full backup copies everything.
- Incremental copies changes since the last backup of any type; fastest to write, slowest to restore.
- Differential copies changes since the last full backup; restore needs the full plus the latest differential.
- The 3-2-1 rule: three copies, on two different media, with one offsite. Add an offline or immutable copy to survive ransomware.
- Rotate media, encrypt backups, and test restores on a schedule.
Your role in an activation
Know the call tree and keep contact lists available offline. Follow manual workarounds as written rather than inventing shadow processes. Report systems that are unavailable and record what you did manually, because reconciliation after recovery depends on those records. Do not restore data on your own initiative.
Worked example
A system is declared with an RPO of 15 minutes and an RTO of 4 hours. Backups run hourly and the alternate site is a cold site needing two days to prepare. Hourly backups mean up to 60 minutes of data loss, which fails the RPO. A cold site fails the RTO. The corrective actions are more frequent or log-shipped backups and a warm site, and the reasoning is that recovery objectives drive design choices, not the reverse.
Marks that are easy to lose
- Confusing backup with archive; archives serve retention, not recovery.
- Treating RAID or cloud sync as a backup - both replicate deletion and corruption.
- Assuming an untested backup is a working backup.
- Mixing RTO (downtime) with RPO (data loss).