Backups, RTO, RPO, BCP, DR, and Resilience

CompTIA Security+ SY0-701

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

Current Exam Facts and How Security+ Tests Judgment Domain Weighting and an 8-12 Week Study Plan Practice Questions, PBQs, and the Missed-Question Notebook

2 Domain 1: General Security Concepts (12%)

CIA and Non-Repudiation Control Types and Categories with Scenario Classification Security Principles: Least Privilege, Defense in Depth, Secure by Design, and Zero Trust Change Management and Business Impact

3 Domain 1: Identity, Trust, and Cryptography Basics

AAA and IAM Concepts Authentication Factors and MFA Traps Authorization Models: RBAC, ABAC, MAC, DAC, and Least Privilege Cryptography, Hashes, Signatures, PKI, and Certificate Decision Rules

4 Domain 2: Threat Actors, Vectors, and Social Engineering

Threat Actors and Motivations Attack Vectors and Attack Surface Social Engineering Types and Clues Supply Chain and Insider Threat Scenarios

5 Domain 2: Threats, Vulnerabilities, and Mitigations - Attacks

Malware Behaviors and Indicators Credential and Password Attacks Network and Wireless Attacks Application, API, and Cloud Attacks with Mitigation Mapping

6 Domain 2: Threats, Vulnerabilities, and Mitigations - Vulnerabilities

Vulnerability Types and Misconfiguration Vulnerability Scanning and Prioritization Secure Coding and Application Mitigations Remediation, Compensating Controls, and Risk-Based Decisions

7 Domain 3: Security Architecture - Secure Architecture Models

Architecture Models and Trust Boundaries Cloud Shared Responsibility and Service Models Zero Trust, SASE, and SSE Concepts Secure Design Review Scenarios

8 Domain 3: Security Architecture - Network Security Architecture

Segmentation, VLANs, DMZ, and Microsegmentation Firewalls, WAF, IDS, IPS, and Proxies VPN, Remote Access, and NAC Wireless Security and Enterprise Network Design

9 Domain 3 Part C: Data Protection and Resilience

Data Classification and Handling Encryption at Rest, in Transit, in Use, and Key Management DLP, Privacy, and the Data Lifecycle Backups, RTO, RPO, BCP, DR, and Resilience

10 Domain 4 Part A: Secure Operations for Hosts, Cloud, Mobile, and IoT

Endpoint and Server Hardening Cloud, Container, and Virtualization Operations Mobile, BYOD, and MDM Embedded, IoT, OT, and Physical Device Security

11 IAM Operations and Access Control

Provisioning, Deprovisioning, and Access Reviews PAM, JIT, JEA, and Service Accounts Federation, SSO, SAML, OIDC, and OAuth Account Attacks and IAM Monitoring

12 Logging, Monitoring, and Detection

Log Sources and Telemetry SIEM Correlation and Alert Triage SOAR, Playbooks, and Automation Detection Use Cases and False-Positive Handling

13 Incident Response

IR Phases and Roles Containment, Eradication, and Recovery Decisions Communication, Escalation, Legal, and Regulatory Considerations Post-Incident Lessons Learned and Metrics

14 Digital Forensics and Investigation

Evidence Handling and Chain of Custody Disk, Memory, Network, and Log Artifacts Order of Volatility and Acquisition Choices Forensic Reporting and Anti-Forensics Traps

15 Vulnerability, Patch, Asset, and Automation Operations

Asset Inventory and Data Classification in Ops Vulnerability Lifecycle and CVSS/Risk Priority Patch, Change, and Configuration Management Automation, Orchestration, SCAP, and Security Tooling

16 Governance, Policies, and Risk Management

Governance Documents: Policy, Standard, Procedure, and Baseline Risk Register and Risk Treatment Quantitative/Qualitative Risk and BIA Exceptions, Acceptance, Ownership, and Reporting

17 Third-Party Risk, Compliance, and Privacy

Vendor Risk Lifecycle and Agreements Due Diligence, Questionnaires, and Monitoring Privacy Concepts and Data Rights Compliance Reporting and Consequences

18 Audits, Penetration Testing, and Awareness

Internal and External Audits and Evidence Penetration Test Types and Rules of Engagement Security Awareness, Training, and Phishing Metrics Personnel and Physical Security Program Controls

19 Final Review and PBQ Labs

PBQ Workflow and Timing Ports, Protocols, and Acronyms High-Yield Tables Firewall, IAM, Log, and Risk PBQ Mini-Labs Final 7-Day Review Plan Mixed Exam Strategy and Missed-Question Remediation

Backups, RTO, RPO, BCP, DR, and Resilience

Key Takeaways Explain This Topic AI

RTO is the target time to restore service; RPO is the maximum acceptable data loss measured in time.

Backups are only trustworthy once restores are tested and documented; follow the 3-2-1 rule.

BCP keeps critical business functions running; DR restores technology after disruption; they overlap but differ.

Resilience uses redundancy, clustering, load balancing, failover, replication, and geographic diversity.

Backup designs must defend against ransomware, deletion, corruption, and regional failure using immutable and offline copies.

Last updated: June 2026

Connecting Business Needs to Design

Security+ SY0-701 expects you to translate business recovery requirements into technical designs. The "best answer" always depends on how much downtime and data loss the business can tolerate, expressed as RTO and RPO.

The Recovery Metrics

Term Meaning Example

RTO Recovery Time Objective: maximum acceptable time to restore service "The portal must be back within 4 hours"

RPO Recovery Point Objective: maximum acceptable data loss measured in time "Lose no more than 15 minutes of orders"

• MTBF Mean Time Between Failures: reliability of a component "A drive fails every 100,000 hours"
• MTTR Mean Time To Repair: average time to fix a failed component "Average 2 hours to swap a node"

If RPO is 15 minutes, a nightly backup cannot satisfy it — you need transaction-log backups or continuous replication. If RTO is 30 minutes, a tape restore from an offsite vault is too slow. Watch the direction trap: RTO is about time-to-restore, RPO is about data-loss tolerance.

Backup Types and the 3-2-1 Rule

• Backup type What it copies Restore notes
• Full All selected data Simplest restore, highest cost/time

Incremental Changes since the last backup of any type Smallest/fastest backup; restore needs full + every increment

• Differential Changes since the last full backup Grows daily; restore needs full + one differential
• Snapshot Point-in-time state Fast rollback, not always a separate copy
• Replication Continuous copy to another system/region Great for availability; can replicate corruption

The 3-2-1 rule : keep 3 copies of data, on 2 different media types, with 1 copy offsite. A modern extension, 3-2-1-1-0, adds 1 immutable/offline copy and 0 restore errors after verification.

Resilience Controls

• Control Purpose
• Redundancy Removes a single point of failure (RAID, dual PSUs, NIC teaming)
• Clustering Multiple systems act as one for high availability
• Load balancing Distributes traffic and routes around failed nodes
• Failover Shifts service to standby resources automatically
• Geographic diversity Limits the blast radius of a site or regional outage
• Immutable backup Write-once copy resists ransomware and deletion
• Offline / air-gapped backup Disconnected copy shielded from online compromise
• Recovery Sites

• Site type Readiness Cost / RTO
• Hot site Fully equipped, data replicated, near-instant cutover Highest cost, lowest RTO
• Warm site Hardware and connectivity ready, data must be loaded Moderate cost, hours of RTO
• Cold site Space and power only Lowest cost, days of RTO
• BCP vs DR vs IR

• Plan Focus Example activity
• Business Continuity Plan (BCP) Keep essential business functions running Manual order intake during an outage

Disaster Recovery Plan (DRP) Restore technology services after disruption Rebuild the database in a recovery region

Incident Response Plan (IRP) Manage security incidents Contain ransomware and preserve evidence

These overlap: a ransomware event may trigger incident-response containment, DR restoration, and BCP workarounds simultaneously.

Worked Scenario

A clinic scheduling system has RTO 2 hours and RPO 10 minutes. A single nightly backup meets neither. A compliant design uses database transaction-log shipping or continuous replication (to satisfy the 10-minute RPO), tested failover to a warm standby (to satisfy the 2-hour RTO), immutable offsite copies for ransomware, documented runbooks, and periodic exercises with clinical staff.

Common Exam Traps

"A backup exists, so recovery is guaranteed" — only a tested restore proves recoverability.

"Replication replaces backups" — replication faithfully copies deletion, corruption, and ransomware encryption.

"RTO measures data loss" — RTO is time-to-restore; RPO is the data-loss tolerance.

"High availability removes the need for DR" — HA cuts downtime but does not replace disaster planning.

Quick Drill

"Back online within one hour" → RTO.

"Lose no more than five minutes of transactions" → RPO.

"Continue payroll manually during an outage" → BCP.

"Rebuild workloads in another region" → DR.

"Backup copy cannot be altered for 30 days" → immutable backup.

Capacity, Power, and Testing Diversity

Resilience extends beyond data copies. Plan for capacity : people (cross-trained staff), technology (autoscaling, spare nodes), and infrastructure (power and cooling). For power, a UPS bridges short outages and a generator sustains long ones; the UPS keeps systems alive during the seconds it takes the generator to start.

Test plans escalate in realism: a tabletop is a discussion walkthrough, a simulation rehearses parts hands-on, a parallel test runs the recovery site alongside production without cutting over, and a full interruption test fails production to the recovery site for real — highest fidelity, highest risk. Choosing the right test type for a stated risk tolerance is a recurring SY0-701 question.