A company's file server is infected with ransomware that encrypts all files. The IT team restores the files from a backup taken before the infection. Users can access their files again, but any changes made after the backup are lost. Which statement best describes the outcome?

The RTO was not met because users lost data

Data recovery failed because not all changes were restored

Data recovery was successful, but the RPO may have been violated depending on the backup age

Disaster recovery is complete because the ransomware is removed

A company's order management system has an RPO of 15 minutes and an RTO of 2 hours. The database is 1 TB and changes rapidly. The current backup strategy is a nightly full backup and transaction-log backups every 15 minutes. Restoring the full backup and applying logs takes about 3 hours. The team is considering implementing a standby replica with synchronous replication. What is the main trade-off of this approach?

The RPO will increase because synchronous replication is slower than backups

Storage costs will decrease because replication uses less storage than backups

The RTO will increase because the standby must be synchronized before failover

Synchronous replication can increase write latency on the primary database

A company's management wants to reduce the RTO for its ERP system from 24 hours to 4 hours. The current backup strategy is a nightly full backup with a 20-hour restore time. The budget is limited, and the RPO can remain at 24 hours. Which option best meets the new RTO within the budget constraint?

Implement a standby server with asynchronous replication and a failover procedure.

Add more tape drives to speed up the nightly full backup restore.

Increase the RTO to 20 hours to match the current restore time.

Switch to differential backups every 6 hours and restore the full plus the latest differential.

What is the primary focus of disaster recovery (DR)?

Preventing all types of cyberattacks

Restoring individual files that were accidentally deleted

Restoring IT infrastructure and systems after a major disruptive event

Managing employee communication during a crisis

A company's email server crashes and the IT team restores the mailbox database from the previous night's backup. Users can access their email again, but messages sent after the backup are lost. Which concept does this situation illustrate?

Disaster recovery is complete because the email service is operational

The RPO was not met because data loss exceeded the acceptable threshold

Data recovery was successful because the backup was restored

The RTO was not met because users could not access email immediately

GIAC Critical Controls Certification

Domain 4Objective 2

Data Recovery GCCC Practice Questions (Page 6)

Part of the Data Protection and Recovery domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 3–5 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

6concepts

Questions 26–30

26application · medium
A company's file server is infected with ransomware that encrypts all files. The IT team restores the files from a backup taken before the infection. Users can access their files again, but any changes made after the backup are lost. Which statement best describes the outcome?
Select an answer first
27expert · hard
A company's order management system has an RPO of 15 minutes and an RTO of 2 hours. The database is 1 TB and changes rapidly. The current backup strategy is a nightly full backup and transaction-log backups every 15 minutes. Restoring the full backup and applying logs takes about 3 hours. The team is considering implementing a standby replica with synchronous replication. What is the main trade-off of this approach?
Select an answer first
28expert · hard
A company's management wants to reduce the RTO for its ERP system from 24 hours to 4 hours. The current backup strategy is a nightly full backup with a 20-hour restore time. The budget is limited, and the RPO can remain at 24 hours. Which option best meets the new RTO within the budget constraint?
Select an answer first
29foundation · easy
What is the primary focus of disaster recovery (DR)?
Select an answer first
30application · medium
A company's email server crashes and the IT team restores the mailbox database from the previous night's backup. Users can access their email again, but messages sent after the backup are lost. Which concept does this situation illustrate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.