iSACA Cybersecurity Fundamentals Certification Practice Exam

How do differential backups accumulate changes over time?

1. By copying all files that have changed since any backup

2. By copying all files that remain unchanged

3. By copying files that differ from the previous incremental backup

4. By copying only files that have changed since the last full backup

The correct answer is: By copying only files that have changed since the last full backup

Differential backups are designed to streamline the backup process by focusing on changes made since the last full backup. This method involves copying only the data that has been modified or created after the most recent full backup. As a result, each differential backup captures all the changes that have occurred, allowing for a more efficient restoration process if needed. Throughout the period between full backups, as new data is added or existing data is modified, these changes are recognized and included in each subsequent differential backup. This is particularly beneficial because, during a restoration, only the last full backup and the most recent differential backup need to be accessed to fully recover the system. This contrasts with other backup methods, such as incremental backups, which only capture changes made since the last backup (full or incremental) and can require restoring multiple sets of backups to achieve full data recovery. In the context of the other options, copying all files changed since any backup would lead to redundancy and larger storage requirements. Copying unchanged files does not align with the goal of effective backups and would waste resources. Focusing solely on files that differ from the previous incremental backup would not capture all changes since the last full backup, which is critical for a comprehensive recovery solution. Overall, the approach of copying only the files