Backup Types Explained: Full, Differential & Incremental

Backup Methods Explained for CompTIA Exams

Oct 9, 2026 · @Ken

The video below walks through how backups actually work, and this write-up fills in the details underneath it — the tradeoffs between backup types, the terms CompTIA names directly, and why "we have a backup" isn't the same as "we can actually recover." For more on where this fits into the broader Security+ exam, the exam tips section below maps it to the exact objective.

Full, Differential, and Incremental Backups

A full backup copies every piece of data in the backup set, every time it runs. That makes restoring simple — everything needed lives in that one backup — but it also makes a full backup the slowest to create and the heaviest on storage, since you're writing the same unchanged files over and over on every run.

A differential backup copies everything that has changed since the last full backup. Each differential grows larger as more time passes since that full backup, but restoring only ever needs two pieces: the last full backup plus the most recent differential. That's a reasonable middle ground between speed and simplicity.

An incremental backup copies only what has changed since the most recent backup of any kind — full or incremental. That makes each incremental backup small and fast to create, but it comes at a real cost during recovery: restoring means replaying the full backup and then every single incremental since, in order. Lose or corrupt one incremental in that chain, and everything after it becomes unrecoverable. For a closer side-by-side comparison of differential and incremental specifically, see the Differential vs. Incremental Backups article.

The 3-2-1 Backup Rule

A single backup sitting next to the system it protects isn't much of a safety net — a fire, a flood, or a single ransomware infection that reaches the backup server can take out the original and the backup together. The 3-2-1 rule is the standard answer to that problem: keep 3 total copies of the data, store them on 2 different types of media, and keep 1 copy offsite. CompTIA's objective text calls this general idea "onsite/offsite" directly, and the same logic scales up from a single backup drive to regionally diverse backups and full geographic dispersion, where entire sites in different regions back each other up.

Snapshots, Replication, and Journaling

CompTIA's objective text names three specific backup-adjacent techniques beyond the basic full/differential/incremental split. A snapshot is a point-in-time copy of a virtual machine or storage volume's state, usually implemented by tracking only what changes after the snapshot is taken rather than copying the whole volume outright — fast to create, and the usual way to checkpoint a VM right before a risky change. Replication continuously copies data to a secondary system as changes happen, rather than on a schedule, which is what lets a standby system take over with only seconds of data loss instead of however long it's been since the last scheduled backup. Journaling takes a different approach entirely: instead of copying data, it logs every change as it happens, which lets a database or file system replay those changes forward or roll them back to reconstruct the exact state at any point in time, not just whenever the last backup happened to run.

Why Backup Frequency and Recovery Testing Matter

How often a backup runs directly sets the ceiling on how much data an organization can afford to lose, which is exactly what RPO measures — if backups run nightly, the worst-case data loss from a failure right before the next backup is basically a full day's work. Backing up isn't the hard part, though; actually recovering from a backup under pressure is. CompTIA's "Recovery" sub-bullet is a pointed reminder that an untested backup is an assumption, not a guarantee — a backup job can report success for months while the restore itself is broken, and the only way to know is to actually practice restoring from it. How long that recovery takes is what RTO measures, and it's where the backup-type tradeoffs above stop being theoretical: a long chain of incremental backups can turn a simple RPO target into a recovery that takes hours longer than anyone planned for.

Why Encrypt Backups

A backup contains the same sensitive data as the system it was taken from, but it doesn't always get the same level of protection — a backup drive or tape can end up shipped offsite, stored in a less-monitored location, or handled by more people than the production server ever is. Encrypting backups means that losing or having one stolen doesn't automatically mean a data breach on top of a data loss, which is exactly why CompTIA lists "encryption" as its own named consideration under backups rather than assuming it's covered elsewhere.

Exam Tips: Where This Fits in SY0-701

Backups sit under objective 3.4, "Explain the importance of resilience and recovery in security architecture," part of Domain 3.0, Security Architecture — 18% of the exam. The objective names backups directly, with seven specific sub-bullets: onsite/offsite, frequency, encryption, snapshots, recovery, replication, and journaling. Every section above maps to one of those seven terms, so a scenario question describing any of them is very likely testing this exact objective.

A few things worth locking in before test day:

• Know the backup-type tradeoff by heart. Full is slow to back up but fast to restore; incremental is the reverse; differential sits in between.
• 3-2-1 isn't just a slogan. Three copies, two media types, one offsite — and it's the reasoning behind onsite/offsite in the objective text.
• "Recovery" means tested recovery. A backup nobody has ever restored from is an unverified assumption, not a working safety net.

Quick Reference

Backup Type	Backup Speed	Restore Speed
Full	Slowest	Fastest
Differential	Moderate	Moderate
Incremental	Fastest	Slowest

You don't need to memorize every vendor's backup terminology. Know the speed and restore tradeoffs between full, differential, and incremental; know the 3-2-1 rule; and know that CompTIA tests backups through seven specific terms — onsite/offsite, frequency, encryption, snapshots, recovery, replication, and journaling.

Source

CompTIA Security+ SY0-701 Exam Objectives — Objective 3.4 (Domain 3.0, Security Architecture)