Hot vs warm vs cold sites and backup types: Security+ explained

Try 3 questions on this

Pick an answer to see why each option is right or wrong.

1. A company runs its order database as a high-availability system with a replica at a second data center. A faulty application update has corrupted thousands of order records. Which of the following best supports recovering the correct records?

   Right. In the game that’s Renown for your Security Architecture building.

   Not that one: A is right. In the game your Security Architecture building would lose a little Renown, and this question would come back later.

   The answerA.BackupsNIST SP 800-34 Rev. 1 warns that high-availability systems cannot replace a solid backup strategy, because corruption of data on a system may propagate through a high-availability system, making it unusable.Your answerB.Failover to the replicaFailing over moves users to the replica, but the replica already carries the corrupted records. SP 800-34 Rev. 1 notes that corruption may propagate through a high-availability system.Your answerC.Load balancingLoad balancing spreads requests across servers so the service stays responsive. It keeps no earlier copy of the data to restore from.Your answerD.ClusteringClustering keeps the database online if one node fails. Every node still serves the same corrupted records.

   Show the full explanation and doc quotes

   Without a backup of the system separate from the system itself, recovery may not be possible. The corrupted writes reached the replica too, so a backup taken before the update is what holds the correct records.

   Written from nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-34r1.pdf

2. After a ransomware attack, a company prepares to restore its file servers from the cyber-attack recovery copies it keeps. Which of the following should those copies be restored onto?

   Right. In the game that’s Renown for your Security Architecture building.

   Not that one: C is right. In the game your Security Architecture building would lose a little Renown, and this question would come back later.

   Your answerA.Hot siteA hot site is a ready-to-run alternate facility for continuing operations. It is not an isolated staging environment, and nothing about it keeps the restored copies apart from the compromised production environment.Your answerB.Public cloudMoving the restore to a provider's infrastructure does not by itself isolate it. SP 800-209's point is separation from the hosts and networks the attack reached, which is what an air-gapped environment provides.The answerC.Air-gapped networkNIST SP 800-209 says cyber-attack recovery copies should be restored (pushed) onto an isolated staging, or air-gapped, environment rather than directly onto the target hosts or applications.Your answerD.Original production serversIt is the fastest route back to service, but SP 800-209 advises against restoring recovery copies directly onto the target hosts. If those servers still hold the attacker's foothold, the clean copies are exposed the moment they land.

   Show the full explanation and doc quotes

   Restoring them straight onto the original servers risks exposing the clean copies to whatever the attacker left behind.

   Written from nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-209.pdf

3. A company leases a backup facility that has power, environmental controls and floor space for servers but no computer equipment. Replacement equipment would be shipped there after a disaster. Which of the following best describes this facility?

   Right. In the game that’s Renown for your Security Architecture building.

   Not that one: C is right. In the game your Security Architecture building would lose a little Renown, and this question would come back later.

   Your answerA.Warm siteA warm site already holds some of the information systems and telecommunications equipment. This facility has no computer equipment at all.Your answerB.Hot siteA hot site is fully operational, with hardware and software already in place. This facility would have to receive equipment first.The answerC.Cold siteThe NIST glossary, from SP 800-34 Rev. 1, defines a cold site as a backup facility with the necessary electrical and physical components of a computer facility but without the computer equipment in place, ready to receive replacement equipment if the organization must move to an alternate site.Your answerD.Failover clusterA failover cluster keeps a service running by moving it between live nodes. It does not describe an empty facility awaiting equipment.

   Show the full explanation and doc quotes

   That matches a facility with power and space but no equipment.

   Written from csrc.nist.gov/glossary/term/cold_site