CompTIA Cloud+ CV0-003 Exam: Backup and Restore Operations

Objective: Given a scenario, perform appropriate backup and restore operations.

Careers in IT have been made and destroyed because of data loss. Failures to develop and adhere to a backup strategy have had severe impacts on organizations as well as those responsible for ensuring data is not lost.
This guide focuses on backup and restore operations. You will learn about different backup types, including incremental, differential, full, synthetic full, and snapshots. You will also learn about backup objects, targets, and policies.
Lastly, you will learn about restore methods, including in-place, alternate location, and restore files.

Topics:
- Backup Types
- Backup Objects
- Backup Targets
- Backup and Restore Policies
- Restoration Methods

1. Which backup type will back up all data that has changed since the last full or incremental backup?
2. True or false: File-system backups should include the file data but not the file metadata.
3. Which backup target is considered faster: tape or disk?
4. Which term matches the following definition?
How long the recovery process should take from the moment that you have been made aware of the loss.

Answers:

1. Incremental
2. False
3. Disk
4. Recovery time objective (RTO)

Backup Types
When you plan a backup strategy, it is important to understand the different backup types. Some types provide quicker backup times but may take longer to restore. Other types are slower to perform the backup but provide a simpler and quicker restore process. In this section you’ll learn these different backup types and explore the advantages and disadvantages of each.

Incremental
An incremental backup includes all files that have changed since the last incremental or full backup.

Incremental backups provide several advantages:
- Each backup takes less time than a full backup and, in most cases, a differential backup.
- Incremental backups are normally smaller than full and differential backups, so they take up less storage space.

However, there are some disadvantages:
- Restoring from incremental backups can be time-consuming. First, the full backup must be restored and then each incremental backup until the incident that caused the loss of data.
- Finding a specific file from an incremental backup can be difficult because the file can be in different locations.

Differential
A differential backup archives any files since the last full backup. Differential backups don’t take into account files that were backed up with previous differential or incremental backups.

Differential backups provide several advantages:
- All of the source data is located in two backups (the full and differential), making it easier to find files than with incremental backups.
- Restoring from a full backup is quicker than other incremental methods.
- A differential backup can be a time-consuming process compared to incremental backups.
- Normally, more storage space is used for differential backups than incremental backups.
- If the backup is performed remotely, a differential backup will use more bandwidth than incremental backups.

Full
With a full backup, everything from the source is backed up. This can include files that haven’t changed since previous backups.

Full backups provide several advantages:
- All of the source data is located in one backup, making it easier to find.
- Restoring from a full backup is quicker than other backup methods.
- A full backup can be a very time-consuming process.
- Normally, much more storage space is used for full backups than other methods.
- If the backup is performed remotely, a full backup will use much more bandwidth than other methods.

Synthetic Full
Suppose you performed the following backups:
- Monday: Full backup
- Tuesday: Incremental backup (all files that have changed since the full backup on Monday)
- Wednesday: Full backup (all files that have changed since the incremental backup on Tuesday)

Now it is Thursday morning and the file system that you have backed up has become corrupted. You need to recover the file system so it has everything that was on the file system when you did the Wednesday backup. To ensure this happens correctly, you need to perform the following steps:
- Recover the full backup that was created on Monday.
- Recover the incremental backup that was created on Tuesday.
- Recover the above it says a full backup was created Wednesday.

Performing these recoveries can take a fair amount of time. When the data on the file system is mission critical, recovery time becomes even more important. In these cases you may want to consider an synthetic full backup. A synthetic full backup is actually like an incremental backup in that it takes less time to back up the file system, but the result is more like a full backup because it merges the results of the incremental backup with the last full backup to create the synthetic full backup.
The advantage of this method is that the incremental backup process is still quick, but after those changes have been applied to the previous full backup, a new full backup can be used to more quickly recover the file system.

Snapshot
Many backup utilities take the following approach to backing up a file system:
Record the metadata for the files being backed up.
Record the metadata for the directories being backed up.
Back up the directories (which really is the list of files that belong in each directory).
Back up the files’ contents.

The problem with this technique is when live (mounted) file systems are backed up. Between backing up the metadata and the file data, it is possible that changes can take place in the file system.
It is best to unmount the file system before backing it up, but unmounting isn’t always possible on production machines. So instead you can make use of a snapshot. A snapshot provides a “frozen image” of the file system at the moment that the snapshot was created. By backing up the frozen image, you ensure a good (error-free) backup.
Note that a snapshot is typically used on virtual machines, not other data structures like databases.

Backup Objects
In this section you’ll explore different types of data that you may consider backing up. How you back up the data depends on the type of data. The type of data is often referred to as the data object.

Application-Level Backup
Many applications have associated data that may need to be backed up separately. For example, a web server includes web page files that may need to be backed up more often than the rest of the operating system.
Most backup utilities allow you to back up either individual directories (folders) or files. In most cases applications store all of their data within a specific directory structure, but if the files are spread out, you need to adjust the backup utility to include all file and directory locations for the application data.

Important Note:
If you utilize both a file-system backup and an application-level backup and the file system needs to be recovered, it is important that both the file-system backup and the configuration backup are restored in the correct order. This will likely be the file system restore first and application-level restore second, but you should review the timestamps of the backups to ensure the correct order is followed (older backups should be restored first).

File-System Backup
One of the most common types of backups is a file-system backup. This sort of backup backs up not only the data (files) but also the structure of the data and the data’s metadata. The structure of the data is the directory or folder structure of the data. The metadata is anything about the file besides the file’s content or the file’s name.

Examples of metadata include the following:
- File ownership
- File type
- Permissions
- Date/timestamps
- Data block location

Database Dumps
A database dump is created when a utility like mySQLdump is used to duplicate the database, either to create a backup or to populate a second instance of the database. It is important to realize that a database dump is specific to the relational database management system (RDBMS), so a database dump of one RDBMS can’t be restored to a different RDBMS. Instead, a migration tool is needed.
A database dump can also be used to back up just the schema or metadata of the database. For example, you may want to create a test database that contains the format of an existing database but not the actual data in the database.

Configuration Files
On an operating system, configuration files are used to configure either applications or features of the operating system. For example, on Linux-based systems the /etc/passwd and /etc/shadow files are used to configure user accounts.
While these files will be backed up as part of file-system backups, they often need to be backed up more regularly. For example, an operating system firewall may have dynamic rules created whenever the system recognizes a hacking attempt. These rules may be added throughout the day. If you rely on a file-system backup to back up the file system once a week—say on Sunday evening—many of these rules may be lost if the file system needs to be recovered mid-week.

Backup Targets
Where you direct the data backup is another important consideration when creating a backup strategy. In this section you will explore the advantages and disadvantages of backing up to tape, disk, or object storage.
Note that disk (block) storage and object storage are covered in the “Block” and “Object” sections, respectively, of “Storage in Cloud Environments.” The focus of this guide will be how these storage devices are used to store backups.

Tape
Tape devices have been used to store data for decades (in fact, the magnetic tape was invented in 1928 to record sound). Tapes provide a good medium for backups because they are affordable and reliable. They also are a good medium for long-term storage.
Tapes do have some disadvantages, however. They are slower than other devices, like disk devices. This means that the backup process is typically slower. They also tend to have a lower amount of available storage per tape, meaning multiple tapes may be required to perform a backup or restore. In many modern cloud-based data centers that use tape devices, tapes in the tape drive are switched out with a robotic arm, but if this capability isn’t available for the data center, the manual process of changing tapes is cumbersome and labor intensive.
Tapes are also much more portable than disk devices because they are, by their design, removable and relatively small. This means they may be more vulnerable to theft. However, strong physical security combined with encryption of the backup can mitigate most of this risk.
Tapes also are not as good to recover specific data from the backup, like a single file. The reason is that the tape must be moved to the correct spot and that process takes time.

Disk
Normally, disk backup devices are compared to tape backup devices. When comparing the two, consider that disk devices are often much faster than tape devices and can almost always hold much more data. Disk devices are also more expensive than tape devices, especially SSD disks.
Disk devices are very good at quickly finding and recovering specific bits of data. The verification process (when the backup data is verified to be error free) is quicker and more efficient on disk backups. Disk backups also typically scale better, but at a higher cost.
Objects are typically stored on disk devices, so they have some of the same advantages and disadvantages as disk backup devices. However, object-based backups have some unique advantages. One advantage is that object storage normally can use a retention schedule. Most object storage solutions allow for old data to be migrated to less expensive storage options and, eventually, removed completely.

Backup and Restore Policies
Random backups don’t serve any real business purpose. It is important to ensure you have a very well-planned backup strategy as well as policies in place regarding how and where the backups are stored. This section will cover these topics as well as restore policies that you should create for your organization.
The idea of retention is to define how long backups should be stored before they are deleted. While keeping backup data indefinitely might sound like a good plan, storing massive amounts of data is costly.

How long should you retain data? There is no rule that fits all scenarios. You should consider the following factors when creating a retention policy:
- How critical is the data to the organization?
- At what point does old data no longer provide any value?
- What are the costs associated with retaining old data?
- Are there any compliance regulations that must be followed in regard to storing old data?

You should start by putting data into different categories. These categories will include data that is governed by compliance regulations, data that is confidential or proprietary in nature, and data that is required for business needs. The actual categories you create are up to you (except for compliance regulation and any policies that have been created by your organization’s board of directors).

After you categorize the data, you need to consider the following:
- How long will the data be retained?
- How and where will it be stored?
- When the data reaches its end of life, how will the data be destroyed?
- How soon can the data be recovered?

Schedules
A schedule is how often you back up your data and what type of backup you will perform. For example, consider the following weekly plan for backing up a file system:
- Sunday @ 10 p.m.—Full backup
- Tuesday @ 10 p.m.—Incremental backup
- Thursday @ 10 p.m.—Incremental backup

When you schedule backups will depend on factors such as how often the data changes. For example, the preceding backup schedule would not work if massive changes were taking place on the file system each day. In that case, a daily backup or backups performed throughout the day would make more sense.

Location
Keep in mind that you want to keep your backups secure. Doing so means ensuring that the data is secure from theft and secure from damage. Therefore, storing your backups in a secure location is a critical component of a backup strategy.
In addition to security, you should also consider where to store your backups in relation to where the original data is stored. For example, suppose you are backing up servers in your data center and you decide to keep your backups in the server room. If a fire breaks out in the server room, you risk losing not only your original data, but all of the backup data. For this reason, many organizations consider storing backups offsite, like in a cloud environment.

Service-Level Agreements (SLAs)
If you are using a cloud vendor to manage your backups, you should be aware of the service-level agreement regarding backups. The SLA should contain provisions for the uptime percentage of the storage that is used by the backup, which can vary based on whether you are using georedundant storage.

To see a sample SLA for a cloud storage service, take a look at the following SLA for Azure Backup: https://azure.microsoft.com/en-us/support/legal/sla/backup/v1_0/.

Note that you might not be using a cloud vendor’s backup solution but still be using the cloud vendor to store your backups. For example, you might use AWS Buckets to store your backups instead of using AWS’s backup service. In this case, you should review the SLA for AWS S3 so that you are aware of the agreement and provisions provided by the SLA.

Recovery Time Objective (RTO)
Suppose an instance’s data has become corrupted and you have been notified that you need to recover this data using backup data. How long should the recovery process take from the moment that you have been made aware of the loss? This is the definition of the recovery time objective. After the recovery is complete, you will need to document how the recovery process went, including if the process was completed in more than the RTO value. This information is especially important for any business-critical data or any data that falls under the governance of regulatory compliance.
Note that RTO is a value that might be covered under an SLA when you are using a vendor to manage or store your backups. See the preceding “Service-Level Agreements (SLAs)” section.

Recovery Point Objective (RPO)
The recovery point objective is designed to determine what is an acceptable amount of data loss when a data disaster occurs. It is almost impossible to ensure that there is no data loss when a data disaster occurs, but it is important to define what amount of data can be lost without having an undesirable effect on business operations.
RPO is described in terms of time, not actual amount of data. For example, your organization may consider a 12–24-hour RPO acceptable for data loss in a noncritical file system, but only a 1–4-hour RPO for data stored in a specific database table.

Mean Time to Recovery (MTTR)
The mean time to recovery is the average time it takes to recover from a failure. The MTTR value is often a component of an SLA or a maintenance contract when you are using a vendor to manage or store your backups. See the earlier “Service-Level Agreements (SLAs)” section.
Typically, the lower the MTTR, the higher the maintenance costs will be. Also note that the R in MTTR is sometimes associated with the words replace, repair, respond, or resolve, depending on the context that it is used in.

3-2-1 Rule
The 3-2-1 rule is that the following should be followed:
- There should be three copies of data.
- There should be at least two different media types.
- At least one copy of the data should be stored offsite.
This rule is designed to best ensure that your data is not at risk of being lost.

Restoration Methods
A restoration method is essentially how the data is restored. In this section you’ll learn several methods that you should consider when developing a backup strategy.

In Place
With an in-place restoration, the data is restored in its entirety, back to the original location. This type of restoration is common when the loss of an entire file system or database is affecting business operations and the restoration must be made as quickly as possible.
There are, however, potential drawbacks to performing an in-place restoration. A corrupted backup or a backup that is out of date might result in further problems after the restoration. If the in-place method is used to partially recover data, it could end up overwriting existing data that is valid and more up to date. In these cases, it would make sense to consider an alternate location, which is covered in in the next section.

Alternate Location
With an alternate location restoration, the data is restored in a different location than where the original data was stored. This technique allows you to review the data to ensure it is complete, not corrupted, and has timestamps that indicate it is recent enough to be considered good data. After the data is verified, it can then be copied to the original location.
The biggest advantage of this technique is the verification of the data. However, this technique can take time, and this may cause further issues because the data will not be available for business purposes for a longer period of time. If speed is important, you should consider the in-place method, described in the preceding section.

Restore Files
In some cases, restoring everything may not be required. For example, if a user accidently deletes a file, only the file needs to be recovered, not all of the data of the backup.
For this reason, you should have a method available to restore individual files instead of restoring the entire backup.
A snapshot restore is normally a bit different from other restore methods because many of the existing files are left alone and only the files that are different in the snapshot are restored. In other words, a snapshot restore is very selective and not used to fully restore all of the files in the file system or directory.


Quiz:
1. Which backup type is considered the most time-consuming?: A.Synthetic full B.Differential C.Incremental D.Full
2. Which file metadata is not included in the list of metadata that should be backed up when performing a file-system backup? A.File ownership B.File type C.File status D.File permissions
3. Which backup target is considered slow? A.Disk B.Object C.Tape
4. The _____ is the average time it takes to recover from a failure. A.SLA B.MTTR C.RTO D.RPO

Answers:
1. Full
2. File status
3. Tape
4. MTTR