Backup and Recovery Operations
Backup and Recovery Operations
This domain tests run mechanics and restore choice. Expect scenarios such as "a VM was deleted at 09:00, which recovery option meets a 15-minute RTO?" and questions about what happens after the first full backup.
How a backup run works
A new group typically takes an initial full, then uses changed block tracking (VMware CBT, Hyper-V RCT) or the agent's change tracking to take forever-incrementals. The platform synthesises full points at retention boundaries without re-reading the whole source. Deduplication and compression are applied inline; a snapshot is the local point-in-time copy, a replica is a copy pushed to a second cluster, and an archive is a copy sent to external target storage.
Recovery options
- Instant recovery / clone - a snapshot is presented to the hypervisor as a datastore and the VM is powered on immediately; storage migration follows later.
- Full VM restore - writes the whole VM back to the original or a new location.
- File-level restore - mounts a snapshot read-only and copies individual files; indexing makes this fast, and some guest operating systems need the agent.
- Application restore - database-aware recovery for SQL Server, Oracle, or SAP HANA, including point-in-time log replay.
- Bare-metal recovery - booting a physical server from recovery media and restoring volumes.
- Recovery from replica or archive - restore is served by the replica cluster; archive restores require a retrieval job first.
Worked example
A VM is deleted at 09:00; the policy has a 1-hour RPO and 30-day retention; the business needs it back within 15 minutes. Reasoning: the newest snapshot is at most one hour old, so data loss is acceptable. A full restore of a large VM would likely breach 15 minutes, so use instant recovery (clone) to power on from the snapshot immediately, then storage-migrate. A replica would only help if replication was configured; an archive copy would first need retrieval, so it cannot meet the RTO.
Traps that cost marks
Confusing clone with a full restore; assuming archived data restores instantly; expecting a replica to exist when the policy never defined one; forgetting that file-level restore depends on indexing or guest tools; assuming the first run is incremental.