Question

During a review of a data center's backup operations, an IS auditor finds that the organization uses a Grandfather-Father-Son (GFS) tape rotation scheme. Daily incremental tapes are overwritten each week, weekly full-backup tapes are overwritten each month, and monthly full-backup tapes are retained for one year. The IT manager claims this scheme is sufficient for both operational recovery and long-term retention. Which risk should the auditor be MOST concerned about with this configuration?

Accepted Answer

The reuse cycle may be too short to satisfy legal or regulatory data retention requirements beyond one year

Answer

The scheme cannot provide any point-in-time recovery because incremental backups are used

Answer

The monthly full backups will consume excessive storage compared to daily incrementals

Answer

The GFS scheme prevents restoration of the most recent business day's transactions