All jobs / IT support / sysadmin
Backup interview questions
Backup questions a IT support / sysadmin can be asked, from first job to senior. Open one to see the strongest answer and why it works.
Someone describes your backups as “three copies, two kinds of media, one off-site”. What is each part for?
The strongest answer: Three copies so losing one is survivable, two kinds of media so one failing technology cannot take both, and one copy off-site and out of reach so a fire or an encryption run cannot get them all
Why it works: Exactly. Each number defends against a different way of losing everything at once, which is why all three are stated.
- Each number covers a different loss.
- Three copies: one can die.
- Two media: one technology can fail.
- One off-site and out of reach.
A user asks you to “just delete this folder, it is junk.” First check?
The strongest answer: Whether it is theirs, whether a backup or recycle path exists, and whether anyone else uses it — then delete with a note
Why it works: Exactly. Ownership and a way back. Helpful deletes are how shared drives die.
- Confirm owner and a recover path.
- Note the delete.
- Do not purge recycle “to be sure.”
- Do not tidy backups by deleting.
Backups are “green” every night. What is still missing?
The strongest answer: A restore you have actually done — a file, a mailbox, a box — green jobs can write junk forever
Why it works: Exactly. Restore is the product. Green is a heartbeat, not a resurrection.
- Test restores, not only jobs.
- Green ≠ recoverable.
- Retention ≠ a test.
- Do not store the key beside the backup note.
How do you know backups are a product, not a light?
The strongest answer: A scheduled restore drill with a named owner and a leftover sentence — green jobs without a calendar are décor
Why it works: Exactly. Drills make leftovers visible. Words like immutable are claims to test.
- Calendar a restore drill.
- Name an owner and a leftover.
- Vendor words are claims.
- Do not assume the cloud cannot lose mail.
Full, incremental and differential — what changes about the restore?
The strongest answer: A differential holds everything since the last full, so a restore needs the full plus the latest one. An incremental holds only what changed since the previous backup, so a restore needs the full plus every incremental since
Why it works: Exactly. The trade is backup window against restore chain, and it is the restore chain that bites during an outage.
- The trade is window versus restore chain.
- Differential: full plus the latest one.
- Incremental: full plus all of them.
- Walk the chain before you need it.
You can restore identity, DNS, and the ticket system. What order do you defend?
The strongest answer: The order in the drill: usually identity and name services before the tools that depend on them — I do not start with the pretty dashboard
Why it works: Exactly. Dependencies first. Pretty and fair are not a boot order.
- Restore what others depend on first.
- Identity and DNS usually before apps.
- Do not start with a pretty dashboard.
- Do not race everything at once.
The board asks if we can “restore everything.” Your sentence?
The strongest answer: What we have restored in a drill, to what point in time, and what we have never tried — I do not say yes to “everything”
Why it works: Exactly. Drilled, point-in-time, untested leftover. Vendors and clouds are not a spell.
- Say drilled / point-in-time / untried.
- Do not say “everything.”
- No vendor-as-yes.
- No invented percentile.
A DR brochure says “hot-hot.” What do you verify?
The strongest answer: A failover you have done, with identity, DNS, and data that people actually use — brochure words are a claim
Why it works: Exactly. Failover of the real path. Photos and invented RTOs are décor.
- Failover the real user path.
- Include identity and DNS.
- Brochures are claims.
- No invented RTO percentile.