Page 1325 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

duplicate every file on the system regardless of the setting of the

archive bit. Once a full backup is complete, the archive bit on every file
is reset, turned off, or set to 0.

Incremental Backups Incremental backups store only those files
that have been modified since the time of the most recent full or
incremental backup. Only files that have the archive bit turned on,
enabled, or set to 1 are duplicated. Once an incremental backup is
complete, the archive bit on all duplicated files is reset, turned off, or

set to 0.
Differential Backups Differential backups store all files that have

been modified since the time of the most recent full backup. Only files
that have the archive bit turned on, enabled, or set to 1 are duplicated.
However, unlike full and incremental backups, the differential backup
process does not change the archive bit.

The most important difference between incremental and differential
backups is the time needed to restore data in the event of an

emergency. If you use a combination of full and differential backups,
you will need to restore only two backups—the most recent full backup
and the most recent differential backup. On the other hand, if your
strategy combines full backups with incremental backups, you will
need to restore the most recent full backup as well as all incremental
backups performed since that full backup. The trade-off is the time

required to create the backups—differential backups don’t take as long
to restore, but they take longer to create than incremental ones.

The storage of the backup media is equally critical. It may be
convenient to store backup media in or near the primary operations
center to easily fulfill user requests for backup data, but you’ll
definitely need to keep copies of the media in at least one offsite
location to provide redundancy should your primary operating

location be suddenly destroyed. One common strategy used by many
organizations is to store backups in a cloud service that is itself
geographically redundant. This allows the organization to retrieve the
backups from any location after a disaster. Note that using
geographically diverse sites may introduce new regulatory
requirements when the information resides in different jurisdictions.