In this video, we walk through 5 ISC practice questions on data backup types and recovery considerations. These questions are from ISC content area 1 on the AICPA CPA exam blueprints: Information Systems and Data Management.
The best way to use this video is to pause each time we get to a new question in the video, and then make your own attempt at the question before watching us go through it.
Data Backup Types and Recovery Considerations
A backup is a separate copy of an organization’s data that can be used to rebuild its systems if the original data is lost or damaged. That might happen because a hard drive fails, an employee deletes the wrong files, or ransomware locks up a server. Organizations rely on three main types of backups: full, incremental, and differential. Each one involves a tradeoff between how much time and storage the backup takes and how easy it is to restore from, which is why most organizations use them in combination.
Full Backups
A full backup copies all of the data in a system every time it runs, whether or not anything has changed since the last backup. Because each full backup is a complete copy on its own, restoring the system requires only that one backup set.
The downside is cost. Copying everything takes the most time and storage of any backup type, and a large full backup can slow down systems if it runs during business hours. For that reason, most organizations run full backups periodically, such as every weekend, and use smaller backups in between.
Incremental Backups
An incremental backup copies only the data that has changed since the most recent backup of any kind. Each one picks up where the previous backup left off.
Example: A company takes a full backup Sunday night and an incremental backup each night after that. Monday’s incremental copies the changes made since Sunday. Tuesday’s copies only the changes made since Monday’s backup.
Because each incremental holds only a small slice of changes, it’s quick to run and uses little storage. The tradeoff comes at restore time. If the company’s server failed Thursday morning, it would need Sunday’s full backup plus the Monday, Tuesday, and Wednesday incrementals, applied in that order. Each incremental builds on the one before it, so if any one of them is missing or corrupted, the restore can’t be completed.
Differential Backups
A differential backup copies all of the data that has changed since the last full backup, no matter how many differential backups have run in between. As a result, each differential grows larger until the next full backup resets the starting point.
Example: Using the same Sunday full backup, Monday’s differential holds Monday’s changes. Tuesday’s holds Monday’s and Tuesday’s changes, and Wednesday’s holds everything changed Monday through Wednesday.
Restoring requires only two backup sets: the last full backup and the most recent differential. If the server failed Thursday morning, the company would need Sunday’s full backup and Wednesday’s differential, since Wednesday’s already contains everything from earlier in the week. Differential backups take more storage than incremental backups, but they make recovery simpler.
Prioritizing Fast Recovery
The recovery time objective, or RTO, is the maximum amount of time a system can be down after a failure before the business is seriously harmed. When the RTO is short, an organization should favor a backup strategy that requires as few backup sets as possible to restore. Each additional set adds time to the recovery and another chance for something to go wrong.
A periodic full backup combined with differential backups fits this need well, because a restore never requires more than two sets. A full backup every night would be even simpler to restore from, but it’s often impractical because of the time and storage it takes.
Limiting Data Loss
The recovery point objective, or RPO, is the maximum amount of data, measured in time, that an organization can afford to lose. When a system fails, everything entered since the last backup is gone, so the amount of data lost depends on how much time has passed since that backup. An RPO of one hour means the organization needs a backup at least every hour.
Backing up more often is what shortens the window of data loss. Full backups are usually too large to run that frequently, but incremental and differential backups are small enough to run many times a day. That’s why many organizations use a hybrid approach, such as a weekly full backup with incremental or differential backups in between, to balance storage, recovery speed, and data protection.
