Module 12

Question 1

Network Management Overview

Answer 1

• Definition: Assessment, monitoring, maintenance of network components • Goals: o Enhance efficiency and performance o Prevent downtime or loss o Predict and resolve issues proactively • Tasks: o Monitor performance baselines o Control user access o Check hardware faults o Maintain QoS o Record asset/software configs o Schedule upgrades based on usage trends • Example: Detecting traffic overload on switch → replace or upgrade before issues occur

Question 2

Environmental Monitoring Factors

Answer 2

• Key Conditions to Monitor: o Temperature (device/rack/room) o Humidity, dew point, barometric pressure o Flooding (liquid detectors) o Smoke or fire o Airflow o Vibration o Motion (security cameras) o Lighting (room lights on/off) o Door status (rack/room doors open or closed) o Power:  Main/UPS voltage  Battery level  Power consumption  Power outages

Question 3

Environmental Monitoring Hardware & Connectivity

Answer 3

• Hardware Capabilities: o Dual power connectors (redundancy) o USB console (direct config) o Web interface (network config) o Extra USB ports (modem/log saving) o Wireless connectivity with sensors • Example Device: ENVIROMUX by NTI (medium enterprise monitoring)

Question 4

Environmental Monitoring Software

Answer 4

• Dashboard Functions: o Displays live sensor data o Set alarm thresholds o Analyze historical data o Remote access (including via smartphone) • Software Example: o PRTG Network Monitor (by Paessler)  Works with: ICMP, SNMP, WMI, HTTPS  Monitors: CPU temp, power data, other sensor inputs • Alert Methods: o Email o SMS (Short Message Service) o Phone calls o Push notifications o Audible alerts (siren, voice) o SNMP traps • Bonus Feature: Remote control of some environmental elements (e.g., adjust temperature)

Question 5

Network Monitoring Tools

Answer 5

• Network Monitor o Monitors traffic across multiple devices o E.g. Spiceworks o Shows traffic patterns, overall flow • Protocol Analyzer o Monitors traffic at a specific interface o E.g. Wireshark o Captures packet-level detail • Monitoring Application Behavior o Connected to switch: sees only broadcast + addressed traffic o Wireless: sees more if in promiscuous mode  Enabled via monitoring software or OS (e.g. Device Manager on Windows) o Port Mirroring / SPAN: switch duplicates traffic to a specific port o In-line TAP (Test Access Point):  2 data ports (send/receive)  1–2 mirror ports (to monitoring software)  Config port (usually rear) o Reporting: Devices report data via SNMP/syslog

Question 6

Monitoring Tool Functions

Answer 6

• Always available functions: o Enable NIC promiscuous mode o Continuous segment monitoring o Capture all traffic on a segment o Capture frames to/from a node o Reproduce network conditions (custom traffic) o Generate activity stats (e.g. % of broadcast frames) • Advanced features (some tools): o Discover all nodes o Establish baselines o Track bandwidth/storage/CPU/memory o Show usage via graphs/tables/charts o Store traffic data o Generate reports o Trigger alarms on threshold breach (e.g. >60% usage) o Identify anomalies:  Top talkers = most data sent  Top listeners = most data received

Question 7

Traffic & Packet Analysis

Answer 7

• Traffic Analysis o Shows flow patterns o Identifies bottlenecks, overloaded services/devices • Packet Analysis o Details of protocols, errors, misconfigs o Requires protocol analyzer • When to use o Monitor abnormal traffic (e.g. network slowdown at 8am) o Locate bad nodes or hacked devices flooding data o Capture & sort traffic by sender volume

Question 8

Packet & Signal Issues

Answer 8

• Runts o < min size (e.g. Ethernet < 64 bytes) • Giants o max size (e.g. Ethernet > 1518 or >1522 w/ VLAN) • Jabber o Device constantly transmits (bad NIC or interference) • Ghosts o Not real frames; stray voltage misread as frames • Packet Loss o Due to noise, unknown protocols, unrecognized ports • Discarded Packets (Discards) o Arrive too late o Causes: congestion, latency, overflow • Interface Resets o Frequent disconnections; often config errors

Question 9

Alerts & Notifications

Answer 9

• Triggered when thresholds are met • May generate: o Emails o SMS o Support tickets o Log entries • Devices that log: routers, switches, servers, workstations

Question 10

Event Logging (Windows & General)

Answer 10

• Event Viewer (Windows): o Views system event logs o Examples:  DHCP failure  Firewall denial • Custom logging possible: o E.g. log if humidity > 60%

Question 11

Syslog Overview

Answer 11

• Purpose: central logging across devices • Standard defines: o Event message format o Event message transmission  Port 514 (UDP), Port 6514 (TLS) o Event message handling • Roles: o Generator: creates event message o Collector: gathers event messages • Severity levels (aka logging/priority levels): o 0 = Emergency o 1 = Alert o 2 = Critical o 3 = Error o 4 = Warning o 5 = Notice o 6 = Informational o 7 = Debug • Filtering: o By severity level (e.g. log ≥ level 4) o By facility (process):  0 = kernel  1 = user-level  4 = security/authentication

Question 12

SNMP Architecture

Answer 12

• NMS (Network Management System) o Console or server o Polls devices for data • Managed Device o Any monitored node o Contains multiple managed objects (CPU, NIC, etc.) o Each object has an OID (Object Identifier) • Network Management Agent o Software on the device o Collects and reports device metrics o Uses minimal processing resources • MIB (Management Information Base) o Hierarchical database of managed objects o Stores object descriptions + performance data o Enables efficient analysis

Question 13

SNMP Protocol Details

Answer 13

• Protocol Type: TCP/IP suite, uses UDP (or TCP if configured) • Ports: o UDP 161 = NMS → Agent o UDP 162 = Agent → NMS • Real-Time Monitoring: Preferred over retroactive log analysis • Device Reconfiguration: Supported (unlike syslog)

Question 14

SNMP Versions

Answer 14

• SNMPv1: o Released 1988 o Basic, rarely used • SNMPv2: o Better performance and security o Still widely used • SNMPv3: o Adds authentication, validation, encryption o Most secure but complex to configure

Question 15

SNMP Security Practices

Answer 15

• Disable SNMP where unnecessary • Limit sources of SNMP messages • Use read-only mode to prevent reconfiguration • Set strong community strings (passwords) • Use different community strings for different device types

Question 16

SNMP Message Types

Answer 16

• Get Request: NMS requests data from agent • Get Response: Agent replies with data • Get Next: NMS requests next MIB row • Walk: Series of Get Nexts across MIB • Trap: o Agent-initiated alert (unsolicited) o Triggered by conditions (e.g., link failure, high temp) o E.g., snmp trap link-status → enable trap o no snmp trap link-status → disable trap o Helps preemptively resolve issues

Question 17

SNMP Data Visualization

Answer 17

• Line Graphs: Track trends over time • Status Maps: o Green = OK o Yellow = Degraded o Red = Failed • Best Practice: o Avoid collecting excessive routine data (e.g., “I’m here” every 5s) o Configure event-based polling (e.g., CPU > 75%)

Question 18

NetFlow Overview

Answer 18

• Vendor: Cisco (proprietary) • Function: Tracks IP traffic across enabled interfaces • Focus: Traffic flows & bandwidth utilization • Records: o Each conversation becomes a flow record o Stored in NetFlow cache, then exported • Analyzer: o Receives flow records from exporters o Provides insights on congestion, patterns, change impacts

Question 19

NetFlow vs SNMP

Answer 19

• NetFlow: o Focus: Traffic relationships, bandwidth usage o Aggregates by flow, not per device o Less deep inspection than full packet capture o Higher traffic visibility, lower resource use o Sampling required to avoid overwhelming network • SNMP: o Focus: Device health, performance, and config o Per-device stats and real-time monitoring o Enables device reconfiguration

Question 20

Network Traffic Management

Answer 20

• Two main focuses: o Performance management  Monitor device & link efficiency  Check if demands are being met o Fault management  Detect faults in devices, links, or components  Signal and respond to issues • Admin responsibilities: o Respond to errors o Adjust device/network configurations o Optimize performance

Question 21

Performance Baselines

Answer 21

• Definition: o Report of normal network operation o Used as a comparison point for future performance o Includes acceptable performance ranges • Data gathered may include: o Backbone utilization rate o Users logged on per hour/day o Protocol types in use o Error stats: runts, jabbers, giants o Frequency of application usage o Bandwidth usage by individual users • Purpose of baselines: o Diagnose problems, misconfigurations, or intrusions o Detect overuse o Evaluate network upgrades o Track changes over time • Establishing baselines: o Requires ongoing documentation o Must be scheduled and reviewed regularly o Tailored to critical functions and user needs

Question 22

Baseline Factors & Estimation Example

Answer 22

• Traffic patterns must account for: o Normal variation:  Time of day  Day of week  Month/season (e.g. retail holidays) o Changes to the network:  New users may use more/less traffic than current ones • Example Estimation: o 500 users → 50% backbone usage at 10am & 2pm o Adding 200 users (40% increase) o Estimate backbone capacity needs to increase ~40%

Question 23

Tools for Baselining

Answer 23

• Small networks: o Use simple/inexpensive tools:  iPerf (CLI-based)  TotuSoft’s LAN Speed Test  TamoSoft’s Throughput Test • Large/WAN networks: o Use comprehensive tools:  Collect traffic per node  Filter by protocol/error types  Measure stats across segments simultaneously • Choosing tools: o Depends on:  Network size  Number of critical applications  Required metrics & visibility

Question 24

Common Network Performance KPIs

Answer 24

• Device availability & performance: o CPU usage o Memory usage o Device temperature o Network speed • Interface statistics: o Data from all interfaces o Identify issues (e.g., frequent power cycles) • Utilization: o Throughput as % of bandwidth o Avoid max-capacity operation o Plan for utilization spikes • Error rate: o % of bits damaged during transit o Often caused by EMI/interference • Packet drops: o Packets:  Damaged  Expired  Blocked by interface o Cause:  Delayed comms  Resends o Monitor for abnormal rates • Jitter: o Variation in latency between packets o Causes out-of-order delivery o Affects user experience o Solved with traffic management techniques

Question 25

Bandwidth Management Techniques

Answer 25

• Definition: Strategies to optimize traffic volume a network can support. • Techniques: o Flow Control – Manages data transmission rate between sender/receiver. o Congestion Control – Prevents/remedies network overload. o QoS (Quality of Service) – Prioritizes critical traffic during congestion.

Question 26

Flow Control Methods

Answer 26

• Purpose: Prevents receiver from being overwhelmed by sender. • Levels: o Data Link Layer – Feedback-based (notifies sender of overload). o Transport Layer – Rate-based (drops excess traffic, no feedback). • Common Techniques: o Stop-and-Wait Method:  Sends one frame at a time.  Waits for ACK before sending next.  Simple, reliable, but slow. o Go-Back-N Sliding Window:  Sends multiple frames (within window size).  Retransmits all frames if one ACK is missing.  More efficient than stop-and-wait. o Selective Repeat Sliding Window:  Only retransmits unacknowledged frames.  Requires receiver to reorder out-of-sequence frames.  Most efficient but complex.

Question 27

Congestion Control – Open-Loop Techniques

Answer 27

• Definition: Prevent congestion before it occurs. • Techniques: o Retransmission Policy: Manages resend frequency to avoid excess traffic. o Window Policy: Uses selective repeat to minimize retransmissions. o Acknowledgment Policy: Uses single ACK for multiple frames. o Discarding Policy: Discards less important traffic. o Admission Policy: Rejects new traffic likely to cause congestion.

Question 28

Congestion Control – Closed-Loop Techniques

Answer 28

• Definition: Address congestion after it occurs. • Techniques: o Implicit Signaling: Sender detects congestion via missing ACKs. o Explicit Signaling: Congested device marks packets.  Backward Signaling: Message to sender.  Forward Signaling: Message to receiver. o Choke Packet: Router notifies sender to reduce transmission rate. o Backpressure: Downstream node halts traffic, pushing pressure upstream.

Question 29

QoS (Quality of Service) Concepts

Answer 29

• Ensures priority delivery of important traffic (e.g., VoIP, streaming, gaming) • Voice/video = delay-sensitive & loss-tolerant • Key goal: Uninterrupted, accurate delivery of time-sensitive data • Requires awareness of: o Applications in use o Protocols used o Bandwidth requirements • VoIP: Prioritize traffic to reduce jitter (variation in delay) • Online gaming: Needs high priority for responsiveness • QoS is most critical during high network usage

Question 30

Traffic Shaping

Answer 30

• Also called packet shaping • Optimizes performance by manipulating packet/stream characteristics • Goals: o Timely delivery of important traffic o Balanced performance for all users • Techniques: o Buffering: Delay low-priority traffic o Priority increase: Raise priority of important traffic o Limit volume per interface per time period o Limit momentary throughput rate

Question 31

Traffic Policing

Answer 31

• Subset of traffic shaping • Enforces bandwidth limits by dropping traffic rather than buffering • Used by ISPs to: o Control bandwidth allocation o Predict needed upstream capacity o Reduce infrastructure cost • Examples: o Customer chooses data caps or throughput limit (with fee tiers) o Dynamic policies based on network usage

Question 32

Real-World Example: Comcast

Answer 32

• In 2007, Comcast: o Injected spoofed TCP RST packets to cut P2P (BitTorrent) uploads o Detected by users via Wireshark o Ruled a violation by FCC • Changed to: o Assigning lower priority to high-volume users during congestion o Example of traffic shaping and traffic throttling

Question 33

Traffic Prioritization Techniques

Answer 33

• Can be applied via: o Router o Multilayer switch o Gateway o Server o Workstation • Prioritization factors: o Protocol o IP address o User group o DiffServ flag (IP packet) o VLAN tag (Ethernet frame) o Service or application • Priority classes: o High / Normal / Low / Slow o Scale 0 (lowest) to 7 (highest) • Ensures high-priority traffic gets through during congestion • Has little effect when network usage is low

Question 34

DiffServ (Differentiated Services)

Answer 34

• Layer 3 QoS technique • Prioritizes all types of traffic (not just time-sensitive) • IPv4: Uses DiffServ field (first 6 bits = DSCP) • IPv6: Uses Traffic Class field • Forwarding types: o EF (Expedited Forwarding):  Guaranteed minimum departure rate  Minimizes delay o AF (Assured Forwarding):  Different levels of router resources  No guarantee of timely arrival during congestion • Lightweight, simple method for large/high-traffic networks

Question 35

CoS (Class of Service)

Answer 35

• Layer 2 QoS technique for Ethernet VLAN traffic • Uses PCP (Priority Code Point) field in Ethernet frame header • PCP = 3-bit field → 8 levels (0–7) • CoS level tells switch how to handle queued frames when congested o Cache or discard based on priority • Often used to manage inter-VLAN traffic efficiently • Part of QoS strategy; works best when all devices support the same protocols • Can be combined with other QoS methods like DiffServ

Question 36

Incident vs. Disaster

Answer 36

• Incident: Any event affecting availability/resources (e.g., hacking, malware, fire) • Disaster: Severe incident; network-wide outage; affects multiple systems/users • Both require advance preparation and procedures

Question 37

Incident Response: 6 Stages

Answer 37

• Preparation o Plan for possible incidents o Backup systems, key info (passwords, configs, vendor SLAs, contacts, laws) • Detection & Identification o Staff trained to recognize incidents o Alert → assigned personnel → escalation decision o Follow chain of command • Containment o Isolate affected systems o Call in response team • Remediation o Identify root cause o Resolve to prevent further damage • Recovery o Restore normal operations o Repair affected systems • Review o Analyze what happened o Improve future preparation

Question 38

Incident Response Team Roles

Answer 38

• Dispatcher o First point of contact o Notifies tech lead & manager o Records incident time, symptoms, relevant info o Handles client/employee communication • Technical Support Specialist o Focus: Fix issue ASAP o Post-incident: Provide report & prevention suggestions • Manager o Coordinates resources o Brings in external help if needed o Ensures policy adherence o Ongoing monitoring & internal comms • Public Relations Specialist o Spokesperson to media/public o Informed on situation & response

Question 39

Data Preservation: Core Concepts

Answer 39

• Purpose: Ensure forensic data is admissible in court • Handled by: First responders (trained/certified), or IT techs until then • Priorities: o Secure data/devices o Prevent contamination o Maintain audit trail & chain of custody

Question 40

Data Preservation Procedures

Answer 40

• 1. Secure the Area o Disconnect from network (unplug Ethernet/disable Wi-Fi) o Leave device running (if safe) o If destructive program active: unplug power from back o Treat as a crime scene (possibly entire room) • 2. Document the Scene o Defensible audit trail (justifiable in court) o Log time/actions + rationale (e.g., “unplugged due to visible virus”) o List people in area & their access o No one else enters; never leave unattended

Question 41

Data Preservation Continued

Answer 41

• 3. Monitor Evidence & Data Collection o Record all collected items o Preserve original state o Never access files (alters metadata) • 4. Chain of Custody o Track all data/evidence movement o Log: what, when, who, condition, security method o Sign hand-offs (you & recipient) • 5. Transport Monitoring o Handled by incident response team o Detailed documentation o Hot seizure: switch power source without shutdown  Prevents loss of in-memory data or lockout • 6. Create a Report o Document everything observed/done o Write report ASAP while fresh o Included in final forensics report

Question 42

Business Continuity and Disaster Recovery Overview

Answer 42

• Business Continuity Plan (BCP): Ensures business continues with minimal interruption during disaster • BCP covers: • Identification of critical operations and backups • Core communications availability under various scenarios • Prevention, damage limitation, and restoration processes • Many businesses fail post-major disaster; BCP improves survival chances • Disaster Recovery Plan (DRP) is a subset of BCP, focused on restoring critical functionality and data • DRP covers worst-case scenarios: natural disasters, cyberattacks, sabotage, terrorism

Question 43

Disaster Recovery Plan Details

Answer 43

• Emergency coordinators’ contact info and staff roles/responsibilities • Backup details: data/servers backed up, backup frequency, onsite/offsite locations • Backup recovery methods to restore data fully • Network topology, redundancy, and carrier agreements for continuity • Regular testing of DRP effectiveness • Crisis management: frequent communication with employees/customers, alternative communication if normal lines fail • Example: 2020 Nashville bombing disrupted cellular services for days, illustrating need for backup comms

Question 44

Disaster Recovery Contingency Sites

Answer 44

• Require alternate site for recovery other than main network location • Options: own disaster recovery site or contract specialized service providers Cold Site • Hardware and connectivity exist but not configured or updated • No current network configuration or connectivity • Restoration requires installing OS, apps, data, configuring devices, ISP re-establishment • Recovery time: weeks • Example: Servers and workstations stored but not operational or connected Warm Site • Hardware present with some configuration and partial updates • Data backups periodically updated (e.g., monthly) on duplicate servers • Recovery time: hours to days • Cost higher than cold site, lower than hot site Hot Site • Fully configured, updated, and connected duplicate network matching live environment • Real-time server mirroring and identical connectivity devices/configurations • Immediate failover and near-zero downtime • Most expensive and maintenance-intensive option • Suitable for organizations with zero tolerance for downtime

Question 45

Cloud-Based Disaster Recovery (DRaaS)

Answer 45

• Disaster Recovery as a Service (DRaaS) or Cloud Site: scalable, cost-effective DR option • Cloud resources can be: • Pre-configured and running (hot cloud site) • Scripted and created on-demand using Infrastructure as Code (IaC) • Risks: Possible loss of cloud connectivity during disasters • Cloud DR offers flexibility and potential cost savings compared to physical sites

Question 46

Power Flaws

Answer 46

• Surge: Momentary voltage increase from lightning, solar flares, electrical issues • Duration: Few thousandths of a second • Damage: Degrades power supplies • Protection: Surge protectors redirect excess voltage to ground • Noise: Voltage fluctuations from EMI or other devices (e.g., fluorescent lights, microwaves) • Damage: Corrupts files, damages circuits • Clean power: Power free from noise via electrical filtering • Brownout (Sag): Momentary voltage decrease causing dim lights, failures, or data corruption • Blackout: Complete power loss • Damage: Can corrupt NOS, cause server failure, requires backup power for graceful shutdown

Question 47

Network Power Devices

Answer 47

• Surge Protector: Protects devices by diverting excess voltage to ground • PDU (Power Distribution Unit): o Acts as power strip for racks o Connects multiple devices to power source o Handles high power loads o Intelligent PDUs: SNMP monitoring, remote power cycling, alerts • UPS (Uninterruptible Power Supply): o Battery backup for power outages o Prevents damage from power fluctuations (surges, noise, sags) o Located in data closets, on racks, or workstations o Two types: Standby UPS (SPS) and Online UPS

Question 48

UPS Types

Answer 48

• Standby UPS (Offline UPS): o Normally powers device from AC mains o Switches to battery when power fails (brief delay) o May cause brief power loss detectable by devices o Cost-effective, suitable for many network devices • Online UPS: o Continuously powers device from battery (charging battery from AC mains simultaneously) o No switching delay, no service interruption o Filters surges, noise, and sags before device sees power o More expensive than standby UPS

Question 49

UPS Selection Factors

Answer 49

• Power requirement (measured in VA = volt-amps): o 1.4 VA ≈ 1 watt o Example: 200 W device needs ~280 VA UPS o Estimate future power needs and consult manufacturers • Runtime: o Longer runtime requires higher capacity UPS o Example: 500 VA UPS might run device 20 mins; 1500 VA for 90 mins • Line conditioning: o Surge suppression plus noise filtering o Noise suppression rated in dB at specific frequencies • Cost: o Small UPS: $100–$300 (5-10 min runtime) o Large UPS (router for hours): $5000+ o Data center UPS: Hundreds of thousands of dollars • Testing: o Test UPS with your equipment o Check warranty and manufacturer reliability • Popular manufacturers: APC, Emerson, Falcon, Tripp Lite

Question 50

Generators

Answer 50

• Provide backup power redundancy during total blackouts • Fuel types: Diesel, propane, natural gas, steam • Used in critical environments (ISPs, telecom data centers) combined with UPSs • UPS covers power immediately; generator starts in ~3 minutes • Generator power: DC output converted to AC for data center infrastructure • Sizing considerations: o Calculate critical electrical load o Estimate required runtime (days possible) • Cost range: $10,000 to $3,000,000 (industrial scale) • Smaller businesses may rent generators • Regularly check fuel quality and levels

Question 51

Backup Systems Overview

Answer 51

• Backup = copy of data/program files for archiving/safekeeping • Essential for fault tolerance & reliability • Compliance standards may require data retention (e.g., HIPAA: medical records ≥7 years) • Audit reports identify backup needs, weaknesses, and compliance gaps

Question 52

Backup Planning Steps

Answer 52

• Step 1: Decide what to back up o User & app data folders o User profiles, state & config files for apps, routers, switches, APs, gateways, firewalls o Example: router startup-config backed up via TFTP server • Step 2: Select backup methods o Cloud backups: managed by 3rd parties, more expensive, reliable, offsite protection o Onsite backups: use proven, compatible hardware/software, error-checking, sufficient capacity o Consider impact on network and users during backup o Evaluate costs, manual intervention needs, and media advantages/disadvantages o Storage media types: optical (DVD/Blu-ray - frequent human intervention), tapes, removable hard drives, SAN o Keep backups secure & offsite for disaster protection • Step 3: Decide backup types o Full: backs up all data every time o Incremental: backs up data changed since last backup o Differential: backs up data changed since last full backup • Step 4: Decide backup frequency o Back up ~every 4 hours of data entry, typically daily or weekly o Windows 10 defaults to hourly incremental backups o Common to backup overnight (low network activity) • Step 5: Develop backup schedule & policies o Example: full backup weekly (Thursday night), incremental daily o Offsite backup media rotation (e.g., weekly or every six months) o Define responsibilities, logging, retention, and legal compliance • Step 6: Verify backups regularly o Test recovery of critical files periodically o Avoid backup system failures that prevent data recovery

Question 53

Backup Best Practices: 3-2-1-1 Rule

Answer 53

• 3: Keep at least three complete copies of data • 2: Use at least two different media types (e.g., hard drive + tape, tape + cloud) • 1: Store at least one copy offsite • 1: Keep at least one backup copy offline (for ransomware protection)

Question 54

Backup Media and Storage Considerations

Answer 54

• Optical media (DVD/Blu-ray): frequent manual disk swapping • Tape drives: fewer manual interventions than optical • Removable hard drives: moderate manual handling • Hard drives can be local, WAN-attached, NAS, or SAN • Backup media must scale with network growth • Ensure backup software supports error checking • Backup systems must be compatible with existing network hardware/software

Question 55

Recovery Metrics: RTO and RPO

Answer 55

• RTO (Recovery Time Objective): o Max allowable downtime before full system restoration o Longer with incremental backups (need to apply all since last full backup) o Shorter with full + differential backups (only full + latest differential needed) • RPO (Recovery Point Objective): o Max allowable data loss measured in time before backup point o Depends on backup frequency and types o Full weekly backups → risk of losing several days of data o Daily incremental/differential backups reduce potential data loss