English
Menu

Information Security Basics

Regarding backups as a defense against ransomware, which method best follows the "3-2-1 rule"?

  1. ACreate three folders on the same file server and copy the data to them once every two hours
  2. BPrepare three backup disks that are always connected to the network, placing two in the same server and one in the same room
  3. CKeep three copies including the original data, store them on two different types of media, and keep one of them in a separate location (such as one disconnected from the network)
Show answer and explanation

Answer: C. Keep three copies including the original data, store them on two different types of media, and keep one of them in a separate location (such as one disconnected from the network)

The 3-2-1 rule is a guideline for backups: keep at least three copies of the data including the original, store them on at least two different types of media (disk, tape, cloud and so on), and keep at least one of them in a separate location. The idea is that a failure of one device, a defect common to one type of media, or damage at one site such as a fire or disaster should not affect all copies at once. Ransomware may encrypt or delete backups that are connected to the network and writable, so it is important to keep at least one copy offline (disconnected from the network) or set so that it cannot be modified for a certain period (immutable). It is also necessary to confirm regularly through restore tests that the data can actually be recovered when needed.

  • A. Copies on the same server are all lost together if that server fails or is encrypted. The "3-2-1" does not describe counts or intervals of copying.
  • B. Disks that are always connected to the network may all be encrypted by ransomware, and because they are all in the same place, they are also vulnerable to disasters.
  • C. Correct. Three copies, two types of media and one in a separate location is the 3-2-1 rule.
Practice this topic Back to topic

Related calculators

Password Brute-Force Time CalculatorCompute the number of combinations and the entropy from the character set and length, and estimate brute-force time

Books on Information Security Basics Ad

As an Amazon Associate I earn from qualifying purchases.

More Information Security Basics questions

  1. Which combination correctly gives the phishing technique and a countermeasure on the user's side?
  2. Which of the following is an example of social engineering?
  3. An email claiming to be from a contact at a business partner says, "Our account for receiving payments has changed, so please pay this invoice and future ones to the new account." When business email compromise (BEC) is suspected, what is the most appropriate response?
  4. In a web application, entering a string such as ' OR '1'='1 in the password field of the login screen lets someone log in without knowing the password. What is this attack called?
  5. As a countermeasure against SQL injection, why are prepared statements with placeholders (parameterized queries) considered more fundamental than removing dangerous characters from the input?