System Administration Week: 5

What should the timeline in a post-mortem include? Check all that apply.

*Actions taken before, during, and after the event* A detailed analysis of the incident, including root cause and scope *Detailed dates and times* A summary of the incident and how long it lasted *The timeline should include actions taken leading up to, during, and after the incident, along with the dates and times when these actions were taken.*

Which of the following backup types are most space-efficient?

Full backups Differential backups *Incremental backups* *Incremental backups are the most efficient. While they start with a full backup, on subsequent runs, they only backup the parts of files that have changed since the last run.*

Why is it important to test backups and restoration procedures? Check all that apply.

To reduce the size of backup data To speed up the backup-and-restore process *To ensure backups work and data can be restored from them* *To ensure that relevant data is included in the backups* *It's super important to test backups and restore procedures to ensure that they actually work! Backup archives could be corrupt or inconsistent, preventing proper restoration. Restore procedures are just as important to test, to ensure that critical data can be extracted from backups if a disaster strikes. Disaster testing can also reveal any gaps in your backup coverage without risking real-world data loss.*

True or false: You can use a RAID array and use rsync to copy critical data to it for backups.

True *False* *RAID isn't a replacement for a backup system. You may use a RAID array as a storage system in your backup server, but copying files to a RAID array won't protect against data corruption or data deletion.*

How can you recover from an unexpected data loss event? Check all that apply.

Write a post-mortem report. *Recover data from damaged devices.* *Restore data from backups.* Design a disaster recovery plan. *If a hard drive or device becomes damaged or fails, you can attempt to recover data using specialized software. If data becomes corrupt or gets deleted, you can also restore the data from backup.*

What's the intent behind writing a post-mortem?

To assign blame for mistakes To assign legal liability *To learn from mistakes and improve in the future* To scare people into avoiding risky behavior *A post-mortem is meant to analyze what happened around an incident to identify what went wrong so it can be avoided in the future.*

A disaster recovery plan is a collection of documented procedures and plans on how to react and handle an emergency or disaster scenario from an operational perspective. What are important elements of a disaster recovery plan? Check all that apply.

*Corrective or recovery measures* *Corrective or recovery measures are those enacted after a disaster has occurred. These measures involve steps like restoring lost data from backups, or rebuilding and reconfiguring systems that were damaged.* Disciplinary measures *Preventative measures* *Preventative measures cover any procedures or systems in place that will proactively minimize the impact of a disaster, like regular backups and redundant systems. Anything that's done before an actual disaster that's able to reduce the overall downtime of the event is considered preventative.* *Detection measures* *Detection measures are intended to alert you and your team that a disaster has occurred that can impact operations.*

What are advantages of on-site backups? Check all that apply.

*Data is more secure because of less outbound traffic.* *The more traffic going out of the network, even for backups, the higher the risk of data being intercepted. On-site backups reduce this vulnerability.* *There is less bandwidth usage.* *Less outbound bandwidth will be used if you aren't backing up off-site.* Data is safe in case of disaster. *There is quicker data access.* *One advantage of on-site backup solutions is that the data is physically very close, which makes accessing the data much quicker.*

What elements should a disaster recovery plan cover? Check all that apply.

*Detection measures* *Preventative measures* *Recovery measures* Drastic measures *A disaster recovery plan shouldn't only have recovery procedures; it should include detection measures so that you can be made aware of an incident, along with preventative measures to help avoid a disaster in the first place.*

Which type of backup only saves copies of files that have been changed or created since the last backup?

*Differential backups* RAID array Incremental backup Complete backup *The advantage of a differential backup is that you aren't storing backups of duplicated, unchanging data. It is a more efficient approach to only back up files that have changed or been created since the last full backup.*

What are good detection measures to incorporate in your organization? Check all that apply.

*Environmental monitoring* Backing up firewall rules Redundant power supplies *System performance monitoring* *Monitoring the environmental conditions in a server room will alert you if things might cause problems for your equipment. System performance monitoring can also alert you to anomalies in requests or traffic to a server.*

Which of these should be included in your backups? Check all that apply.

*Firewall configurations* A downloads folder Family vacation photos Sales databases *Critical data for an organization, like firewall configs and relevant databases, should be included in the backup plans.*

What types of backup schemes are available? Check all that apply.

*Full backup* *Differential backup* *Incremental backup* Partial backup *A full backup makes a copy of all files on each run. A differential backup starts with a full backup and only backs up changed files on each subsequent run. An incremental backup also begins with a full backup, but only backs up the portions of files that have changed on future runs.*

What's magnetic tape backup media best suited for?

*Long-term archival data* Low-latency cached data Cheap backup systems Quick and efficient backups

The unthinkable happens and disaster strikes, crippling your network. You implement your disaster plan, but it doesn't go smoothly. You decide to investigate. What is a commom term in the IT community for this investigation?

*Post-mortem* Post-disaster inquiry After-outage analysis Recovery inspection probe *Imagine that something did go wrong with your systems, and you had to use your disaster plan. A post-mortem is a way for you to document any problems you discovered along the way and how to fix them.*

Common concerns with backups are disk failure, lack of redundancy, and the necessity of future growth of disk capacity. Which backup method adresses these concerns and has multiple levels of use depending on how you want to prioritize features like performance, capacity, or reliability?

*RAID array* Complete backup Incremental backup Differential backups *RAID stands for Redundant Array of Independent Disks. It's a method of taking multiple physical disks and combining them into one large virtual disk.There are multiple types of RAID configurations, called levels.*

What are good recovery measures to incorporate in your organization? Check all that apply.

*Restoring server configs from backup* *Following detailed recovery plan documentation* Monitoring for internet line outages Maintaining redundant servers *Maintaining backups of server configs will make restoring a damaged system much quicker and easier. Detailed documentation on how exactly to do this will also speed up this process.*

How can you verify that your disaster recovery plan will be effective? Check all that apply.

*Through thorough testing* By waiting for a disaster *Through disaster simulations* You can't *Testing various aspects of your recovery plan will ensure that the documented procedures will work as they're designed. This testing can be accomplished by simulating disasters and having teams run through documented procedures.*

What are good preventative measures to incorporate in your organization? Check all that apply.

Monitoring and alerting systems *Redundant systems* *Having redundant systems is a great preventative measure. If one system fails or goes offline, the secondary system can prevent a complete outage until the primary system can be restored.* *Regular backups* *Taking regular backups of your systems and critical data can reduce the overall downtime caused by a disaster.* *Accessible and up-to-date documentation* *Good documentation is considered a preventative measure, since it can avoid costly mistakes and make handling outages or system failures easier.*

Budget constraints aside, what is the ideal backup solution? No backup

No backup *Both on-site and off-site backup* Off-site (cloud) backup On-site backup *It's often recommended to have both on-site and off-site backups if it's within your organization's budget.*

Where is it best to store backups, physically?

On-site Off-site In a safe *Across multiple locations* *Ideally, backups should be stored in multiple physical locations to reduce the risk of a catastrophe causing you to lose your backups. Typically, data would be backed up somewhere locally, and the backups would be replicated and stored off-site.*

You are performing a network risk assessment to develop your disaster recovery plan. Which of these are examples of corrective or recovery measures? Check all that apply.

Redundancy solutions *Restoring data from backup* *Restoring lost data is a critical part of restoring operations.* *Rebuilding and reconfiguring services* *To restore operations, servers need to be rebuilt and reset, and services need to be restored.* *Hardware repair and replacement* *In the case of physical damage during a disaster, nonfunctioning parts or devices may need to be replaced.*

What's a commonly overlooked part of a post-mortem report?

The summary The timeline What went poorly *What went well* *It's just as important to document the systems that worked correctly and helped to mitigate the disaster!*

Why are detection measures included in a disaster recovery plan?

They aren't *Because it's important to know when a disaster occurs* Because they prevent data loss Because they make recovering from data loss easier