Question

During a review of a company's production database server, an IS auditor notes that critical data is stored on a RAID 5 array with hot-swappable drives. The IT manager states that because of this configuration, no separate backup process is needed for the database. What is the auditor's MOST appropriate conclusion?

Accepted Answer

The RAID configuration is a fault-tolerance control that protects against disk failure but does not replace backups for logical corruption, deletion, or disasters.

Answer

RAID 5 provides adequate data protection, so the absence of a backup process is an acceptable risk.

Answer

The server should be upgraded to RAID 1 mirroring, which would then eliminate the need for backups.

Answer

Hot-swappable drives ensure zero data loss, making the RTO and RPO irrelevant for this system.