Backup types and the 3-2-1 backup rule, explained

Backups are where the A+ exam meets the real job

The exam wants four things from you here: the backup types themselves, which are full, incremental, differential, and synthetic full; the role of the archive bit; the 3-2-1 rule for keeping copies safe; and the reason a backup you never tested is not really a backup at all. None of it is hard once you see how the pieces connect.

We will go type by type, then cover the rules, then name the mistakes that quietly cost people their data. If you want to drill the vocabulary after reading, Study mode has quick checks on this objective so the terms stick before exam day.

What backup types does the A+ Core 2 exam test?

Four types: full, incremental, differential, and synthetic full. A full copies everything. Incremental and differential each copy only what changed since a reference point, but they choose that reference point differently, which is exactly where it is easy to slip.

A full backup copies every selected file, every time. It is the simplest and safest to restore from, because everything you need sits in one complete set. The tradeoff is time and storage. A full backup of a large drive is slow to create and eats disk space, so most shops run a full on a set schedule, say weekly, and use lighter backups on the days in between.

Incremental and differential backups both save only the files that changed, which keeps the daily job small and fast. The difference is what each one compares against, and that single detail decides how quickly you can restore later. A synthetic full is the clever middle option. Instead of re-reading every file from the source machine, the backup server builds a fresh full backup by merging an existing full with the incrementals that came after it. You end up with a true full backup without hammering the production system during business hours.

• Full: copies all selected data on every run. Slowest to back up, but the fastest and simplest to restore.
• Incremental: copies data changed since the last backup of any type, whether that was a full or another incremental. Fast backups, slower restores.
• Differential: copies data changed since the last full backup only. Backups grow larger as the week goes on, but restores are quicker.
• Synthetic full: a full backup assembled by the backup server from an existing full plus later incrementals, which spares the source system the heavy read load.

Incremental vs differential: what is the actual difference?

Incremental backs up what changed since the last backup of any kind. Differential backs up what changed since the last full. That is the whole distinction, and the A+ exam loves to test it, so it is worth slowing down here.

Picture a full backup on Sunday night. On Monday, an incremental saves Monday's changes and marks them as handled. On Tuesday, the next incremental saves only Tuesday's changes, because Monday's were already captured. Each incremental stays small, so backups run fast all week. The cost shows up at restore time. To rebuild the drive you need Sunday's full plus every incremental in order, Monday through Friday. Lose or corrupt one link in that chain and the whole restore is in trouble.

A differential ignores the other differentials and always compares back to the last full. Monday's differential holds Monday's changes. Tuesday's differential holds Monday and Tuesday. By Friday it holds the entire week, so the backups grow heavier each day. The payoff is a simple restore. You need only two sets, the last full and the most recent differential. Fewer moving parts means faster, more reliable recovery.

The archive bit is the mechanism underneath both. When a file is created or changed, the operating system flips an attribute on that file, the archive bit, to signal that it needs backing up. A full or incremental backup clears that bit after saving the file, so the file is not saved again until it changes. A differential reads the bit but leaves it set, which is exactly why a differential keeps re-saving everything since the last full. Modern backup tools often use snapshots or change journals instead, but the exam still expects you to know the archive bit story.

What is the 3-2-1 backup rule?

Keep 3 copies of your data, on 2 different types of media, with 1 copy kept offsite. It is a simple rule that survives almost every disaster short of pure bad luck, which is why it shows up on the exam and on every good backup plan.

The three copies are your live data plus two backups. Two media types matter because identical hardware can fail in identical ways, so a copy on an internal drive and a copy on an external drive or a NAS spreads the risk. The one offsite copy, whether that is cloud storage or a drive kept at another location, protects you against fire, theft, flood, or a ransomware outbreak that reaches everything on the local network. Miss any one of the three and you have a single point of failure hiding inside your plan.

Rotation schemes decide which media you reuse and when. Grandfather-father-son is the classic example. Daily backups are the son, a weekly backup is the father, and a monthly backup is the grandfather. You rotate a small set of media through those cycles so you always have recent daily copies plus older weekly and monthly checkpoints to fall back on. It is a practical way to balance how much history you keep against how much media you have to buy.

Why RAID is not a backup, and why you test restores

RAID keeps a system running when a drive dies. It does not protect against deletion, corruption, or ransomware, because those problems spread across the array instantly. RAID is redundancy, not a backup, and mixing up the two is a classic new-tech mistake.

A mirrored or parity RAID array means one or more drives can fail while the machine stays online, which is great for uptime. But if you delete the wrong folder, a file gets corrupted, or ransomware encrypts your data, the array faithfully writes that damage to every disk in real time. There is no earlier version to roll back to. If you want the deeper mechanics, our guide on why RAID protects uptime, not your files walks through the levels. For the exam and the job, hold this line: RAID is availability, backup is recovery, and a serious setup needs both.

The last habit is the one people skip, and it is the most important: test your restores. A backup job can report success for months while quietly writing corrupt or incomplete data, and you will not find out until the day you actually need it, which is the worst possible moment to learn the truth. Pick a file, restore it somewhere safe, and confirm it opens. Then periodically run a larger test restore to prove you can rebuild a full system, not just copy a few files back. A backup you have never restored from is a hope, not a plan.

Backups are a promise you make before the bad day

Backup types and the 3-2-1 backup rule reward a little memory work with a lot of real-world weight. Know that full, incremental, differential, and synthetic full differ mainly in what they compare against and how fast they restore. Remember what the archive bit does, keep three copies on two media types with one offsite, and never trust a backup you have not tested. Get comfortable here and you will pass this slice of Core 2 and, more importantly, become the tech who has a calm answer ready when someone's files disappear. Run a few reps on the terms, then move on to the next objective knowing this one is handled.