Data Security, Backup, and Virus Protection
What this domain covers
The exam tests threat recognition, protective measures, and heavily the difference between backup types and how recovery actually works in practice.
Core rules
- Security goals: confidentiality, integrity and availability.
- Malware families: virus (needs a host file), worm (spreads by itself across the network), trojan (disguised as useful software), ransomware (encrypts files and demands payment), spyware (silently collects data).
- Protection: strong unique passwords, two-factor authentication, timely updates, firewall enabled, antivirus with current definitions, encryption of sensitive data, and caution with links and attachments (phishing).
- Backup types: full (everything, clears the archive bit), incremental (changes since the last backup of any kind), differential (changes since the last full).
- Follow 3-2-1: three copies, two media types, one off-site or offline. Test restores.
Worked example
A full backup runs on Sunday and incremental backups run Monday to Saturday. The disk fails on Friday. To restore you need the Sunday full plus the incrementals for Monday, Tuesday, Wednesday and Thursday, applied in that order. If differentials had been used instead, only the Sunday full plus Thursday's differential would be needed. That single comparison explains most marks lost here.
Traps
- Calling RAID a backup; it guards against disk failure, not deletion, ransomware or fire.
- Mixing up incremental and differential restore chains.
- Believing antivirus alone is sufficient protection.
- Trusting an untested backup.