4.4.3. Testing and Backups

💡 First Principle: Untested backup and recovery plans are wishes, not plans. Regular testing validates that recovery procedures actually work under realistic conditions. Backup strategies must balance recovery speed, data completeness, and storage cost.

Testing types:

• Tabletop exercises — stakeholders walk through a scenario verbally, discussing their responses. Lowest cost and disruption; tests decision-making, not technical capability.
• Failover testing — actually switching to backup systems to verify they work. Tests technical readiness; risks production disruption.
• Simulation — realistic scenario testing without affecting production. Tests both technical and procedural capabilities.
• Parallel processing — running backup systems alongside production to verify they produce identical results before cutting over.

Backup types:

Archive bit — on Windows file systems each file carries an archive attribute that is set whenever it changes. Full and incremental backups clear it after copying, so an incremental captures only what changed since the last backup of either kind; a differential copies every file marked changed since the last full but does not clear the bit, so it grows each day until the next full.

Backup considerations: onsite backups for fast recovery, offsite backups for disaster recovery, encryption for backup data in transit and at rest, regular restore testing to verify backup integrity. Ransomware resilience: ransomware hunts for reachable backups and encrypts or deletes them, so backups on the same network segment or with the same credentials as production fail together with it. Keep at least one copy isolated (offline, air-gapped or in a separate account/segment) and immutable (write-once storage or object lock that cannot be altered or deleted during the retention period), following the 3-2-1 rule (three copies, two media types, one offsite), and test restores against the RTO.

Replication — real-time copying of data to a secondary location. Provides near-zero RPO but requires sufficient bandwidth and introduces complexity. Synchronous replication confirms a write only after both the primary and the secondary have committed it: no data loss (RPO of zero) but added write latency, so it is usually limited to nearby sites. Asynchronous replication confirms the write at the primary and copies it afterward: faster and workable over long distances, but the secondary can lag, so some recent data can be lost (RPO above zero).

Journaling — recording all changes to data in a transaction log, enabling point-in-time recovery by replaying or rolling back transactions.

⚠️ Exam Trap: Incremental backups are fastest to create but slowest to restore (you need the full backup plus every incremental since). Differential backups are a middle ground (you need only the full plus the latest differential). Know the trade-offs for each.