Cram Sheet · Domain 3.4

Domain 3.4 Study Guide

Resilience and recovery — CompTIA Security+ SY0-701

This domain is one interlocking system, not a list of unrelated facts: something fails, so you need redundancy (high availability, site resiliency, platform diversity) to keep running, a documented plan (COOP) to follow, ways to test that plan before you need it, capacity to absorb the load, and backups plus power to actually recover the data and stay online. Read each section in that order once, then use the tables as your quiz-day anchor.

1. High Availability: Clustering vs. Load Balancing

Both make a service survive a single device failure, and both get lumped together because of that. The difference is what the group of devices is.

Concept	What it is	Key detail
Clustering	Two or more servers act as one logical server	Usually same OS; users see a single device
Load balancing	Traffic is spread across multiple independent servers	Servers can differ (even different OSes); balancer adds/removes servers as needed

Anchor: Clustering = “one server, disguised as many.” Load balancing = “many servers, sharing the work.” If the question says the servers “appear as a single device,” that's clustering. If it says traffic is “distributed” or a device is “removed if it stops responding,” that's load balancing.

2. Site Resiliency

Hot, Warm, and Cold Sites

Site type	Hardware	Data/software	Recovery time
Hot site	Fully stocked, constantly updated, ready and waiting (exact replica)	Continuously replicated	Minutes (“flip a switch”)
Warm site	Rack space, no data	You bring software and data	Days
Cold site	Empty building	You bring everything, including people	Weeks to months

Anchor: Hot = hardware AND data ready. Warm = hardware ready, data is not. Cold = nothing ready. Cost and recovery speed move together: hot is fastest and most expensive, cold is slowest and cheapest.

Other Site Variations

Term	What it means
Geographic dispersion	Recovery site is physically far from the primary site, so one regional disaster (hurricane, flood) can't take out both
Virtual site (hot/warm/cold)	Same three tiers, built in the cloud instead of a physical building. Virtual hot = fully replicated and instantly accessible; virtual cold = resources sit dormant until activated
Mobile site	Portable unit (trailer, tent) that can be configured as hot, warm, or cold; used for rapid, flexible deployment

Platform Diversity and Multi-Cloud

Platform diversity: deliberately running different operating systems, vendors, and technologies so a vulnerability or flaw specific to one platform can't take down the whole organization at once. Windows-specific vulnerabilities generally don't touch Linux or macOS, and vice versa.

Multi-cloud systems: the same principle applied to cloud providers. Spreading workloads across AWS, Azure, and Google Cloud means one provider's outage or breach doesn't take everything down with it.

Don't confuse with physical/environmental controls like fences, lighting, or video surveillance. On a practice exam, “platform diversity” as an answer choice is a resilience/technology-diversity concept, not a physical security control, even when it's listed alongside them.

Exam framing: a question describing “different vendors, cryptographic solutions, platforms, and controls” reducing the impact of a single attack or failure is describing platform diversity. The trade-off worth knowing: added training overhead and integration complexity between disparate systems.

3. Continuity of Operations Planning (COOP)

The plan for keeping the business running when technology fails, not just the technology itself. If systems go down, COOP defines the manual fallback: paper receipts, phone-based transaction approvals, manual processes. These procedures must be documented and tested before a real disruption happens, not improvised during one.

4. Recovery Testing Methods

All four validate a recovery plan without waiting for a real disaster. They differ in what they actually exercise.

Method	Anchor	What happens
Tabletop exercise	Talk it through	Key players discuss a simulated disaster around a table; no systems are touched
Failover test	Actually switch over	Redundant infrastructure (routers, firewalls, switches) takes over from a failed unit, often automatically
Simulation	Fake the attack	A real-feeling event is run against real users, e.g. a phishing campaign, to test filters and user response
Parallel processing	Split the load	A process runs across multiple CPUs/systems at once; a faulty processor is removed while the rest keep working

Anchor: Tabletop = discussion only. Failover = infrastructure swap. Simulation = a realistic test run against people or systems (phishing tests live here). Parallel processing = performance and fault isolation across multiple processors, not really a “disaster drill” at all.

5. Capacity Planning

Matching supply to demand so you have neither outages (too little) nor wasted spend (too much). CompTIA groups it into three areas:

Area	Focus
People	Staffing for services that need human intervention, e.g. call centers; balancing understaffing (slow response) against overstaffing (wasted cost)
Technology	Choosing systems that can scale, e.g. distributing web load, clustering/splitting databases, using on-demand cloud services
Infrastructure	The underlying framework: CPU, network, storage. Physical devices take longer to deploy; cloud-based devices deploy faster for unexpected capacity needs

6. Backups

Full, Incremental, and Differential

Type	Captures	Backup speed	Restore speed
Full backup	Everything, every time	Slowest	Fastest (one set)
Incremental backup	Changes since the last backup (full or incremental)	Faster than full, slower than differential	Slowest (restore full, then every incremental in order)
Differential backup	Changes since the last full backup	Faster than incremental	Faster than incremental (restore full, then the one latest differential)

Why these get confused: both incremental and differential back up “just the changes.” The difference is the reference point. Incremental always measures from the last backup of any kind (so each one is small, but restore has to replay every link in the chain). Differential always measures from the last full backup (so each one grows larger over time, but restore only ever needs two pieces: the full, then the latest differential).

Onsite vs. Offsite, Frequency, Encryption

Consideration	Detail
Onsite backups	No internet link needed, immediately available, generally cheaper
Offsite backups	Transferred over internet/WAN, survives a disaster at the primary site, restorable from anywhere. Most organizations run both.
Frequency	Systems with high change rates need more frequent backups; organizations often keep layered daily/weekly/monthly sets
Encryption	Backup media, especially offsite or cloud, holds a full history of sensitive data in one place. Encrypting it means a stolen or intercepted backup is unreadable without the recovery key

Snapshots, Replication, and Journaling

Technique	Anchor	How it works
Snapshot	Point-in-time copy	Captures an entire system's state at one moment; common on VMs and cloud. Later snapshots capture only the changes since the last one, so you can revert to any saved point.
Replication	Near real-time mirror	Data is continuously synchronized to another location, so a current copy always exists elsewhere
Journaling	Write-ahead log	Before data is written to storage, a journal entry records the intended change. If power fails mid-write, the journal is used to recover cleanly instead of restoring an entire backup

Exam framing: journaling protects against corruption from an interrupted write — it is not a substitute for full/incremental/differential backups or offsite copies. Use it alongside other backup methods, not instead of them.

7. Power Resiliency

Solution	Duration	Detail
UPS (uninterruptible power supply)	Short-term	Covers blackouts, brownouts, and surges immediately. Types: offline/standby, line-interactive, online/double-conversion.
Generator	Long-term	Requires fuel storage, can power an entire building, but takes a few minutes to spin up, during which the UPS bridges the gap.

Anchor: UPS bridges the first few minutes. Generator takes over for the long haul. They work together, not as alternatives to each other.

Domain 3.4 · Resilience and recovery · Sources: Professor Messer SY0-701 Course Notes, CompTIA Security+ Study Guide v1, CompTIA Security+ Study Guide 9th Edition (Gibson)