Objective 4.3: Given a scenario, implement workstation backup and recovery methods

Cert: CompTIA A+ Core 2 (220-1202) V15 Domain: 4.0 Operational Procedures Weight: Part of the 21% Operational Procedures domain Depth: Given a scenario, implement. The candidate must select backup types, recovery destinations, test backups, and apply rotation schemes.

What this objective tests

You should know the differences between full, incremental, differential, and synthetic full backups; recovery destinations (in-place vs alternative); the importance of testing backups; and rotation schemes including 3-2-1 and grandfather-father-son.

Key facts

Full backup:

• Complete copy of all selected data, every time it runs.
• Pros: simplest restore (one set). Slow to back up, large storage footprint.

Incremental backup:

• Backs up only files changed since the LAST backup of any type.
• Pros: smallest backup size per run, fastest backup. Restore needs full + every incremental since.
• Cons: longer restore chain; loss of any single incremental loses subsequent data.

Differential backup:

• Backs up files changed since the LAST FULL backup.
• Pros: restore needs only full + most recent differential. Backup grows daily until next full reset.
• Cons: backup size grows over time between fulls.

Synthetic full backup:

• Built from a full + subsequent incrementals, merged into a new "full" without re-reading source data.
• Acts like a full for restore purposes; faster to create than a real full because data isn't re-read from source.
• Modern backup tools (Veeam, Acronis) use synthetic full for efficient daily protection.

In-place / overwrite recovery:

• Restore back to the original location, overwriting current data.
• Use when current data is corrupt or destroyed (ransomware, drive failure).

Alternative location recovery:

• Restore to a different location (different drive, different folder, different server).
• Use when you want to compare backed-up version to current, or recover specific files without disturbing current state.

Backup testing:

• Periodic verification that backups can actually be restored.
• "We backed up" without verifying restore is the canonical bad practice. Test restores quarterly at minimum.

Frequency (of backup testing):

• Monthly, quarterly, annually depending on criticality.
• At minimum: test restore of any new backup configuration before relying on it; periodic test restores of production backups thereafter.

Onsite vs offsite backup:

• Onsite: backup stored at the same location as production. Fast to restore. Vulnerable to same physical event (fire, flood, theft, ransomware encrypting backup share).
• Offsite: backup stored at a different location. Survives site-level disasters. Slower to restore.
• Modern best practice: both.

Grandfather-Father-Son (GFS):

• Rotation scheme using multiple backup generations.
• Son: daily backups (typically kept for 1 week).
• Father: weekly backups (kept for 1 month).
• Grandfather: monthly backups (kept for 1 year+).
• Provides recovery at multiple time depths.

3-2-1 backup rule:

• 3 copies of data (original + 2 backups).
• 2 different media types (e.g., local disk + cloud, or local disk + tape).
• 1 copy offsite.
• Modern variant: 3-2-1-1-0: add 1 immutable copy and 0 errors after verification.

Common gotchas

• Backup ran successfully, restore fails. Verify restore quarterly. Backup that can't restore = no backup.
• All backups onsite. Office fire = data loss. Need offsite.
• Onsite backups on a writable share. Ransomware encrypts backup share too. Use immutable backups, separate credentials, or pull-based backup architecture.
• Incremental chain too long. Months of incrementals with no full reset. One missing piece = lost continuity. Periodic full or synthetic full.
• Backup window not coordinated with production. Backup runs during business hours and slows everything down. Schedule maintenance windows.
• GFS naming confusion. Daily incremental != "Son" by some conventions. Clarify what each tier holds.
• Cloud backup is the only copy. Sometimes cloud has outages. 3-2-1 always wins.

Real-world context

Workstation backup strategy for an SMB:

• OneDrive / Google Drive folder backup for user files: continuous, cloud, single click to restore. Solves accidental delete, drive failure, ransomware (with version history).
• Windows File History or macOS Time Machine for local user data redundancy.
• Image-based backup (Macrium Reflect, Acronis, Veeam Agent for Windows) for full-system restore: bare-metal recovery, full drive image, scheduled.
• 3-2-1 across the fleet: OneDrive (cloud) + local backup (different media) + at least one offsite copy.

Recovery scenarios and the right backup:

• Single file accidentally deleted: OneDrive version history or File History.
• Drive failure: image-based backup, restore to new drive.
• Ransomware: restore from clean backups (verified pre-infection); reimage as needed.
• Lost laptop: new device, restore user data from cloud backup; image required for full-system restore (less common for workstations because user data is the priority).

For servers and infrastructure, the same patterns scale up but with backup software designed for servers (Veeam Backup & Replication, Datto, Acronis Cyber Backup).

Sources

• [CompTIA A+ 220-1202 Exam Objectives Version 4.0, Section 4.3](../../../../../../30-RevyTechJourney/CompTIA%20A%2B%20220-1202%20Exam%20Objectives%20%284.0%29.pdf)
• [Veeam: 3-2-1 Backup Rule](https://www.veeam.com/blog/321-backup-rule.html)
• [CISA: Cyber Essentials Toolkit](https://www.cisa.gov/cyber-essentials)
• [Microsoft Learn: Windows Backup](https://support.microsoft.com/en-us/windows/back-up-your-windows-pc-87a81f8a-78fa-456e-b521-ac0560e32338)