Practice Study 1 Flashcards
You’ve hired a third-party to gather information about
your company’s servers and data. The third-party will
not have direct access to your internal network but can
gather information from any other source. Which of the
following would best describe this approach?
❍ A. Backdoor testing
❍ B. Passive reconnaissance
❍ C. OS fingerprinting
❍ D. Grey box penetration testing
❍ B. Passive reconnaissance
Passive reconnaissance focuses on learning as much information from open sources such as social media, corporate websites, and business organizations.
The incorrect answers:
A. Backdoor testing
Some active reconnaissance tests will directly query systems to see if a
backdoor has been installed.
C. OS fingerprinting
To fingerprint an operating system, you must actively query and receive
responses across the network.
D. Grey box penetration testing
A grey box penetration test is a focused approach that usually provides
detailed information about specific systems or applications.
Which of these protocols use TLS to provide secure communication? (Select TWO) ❍ A. HTTPS ❍ B. SSH ❍ C. FTPS ❍ D. SNMPv2 ❍ E. DNSSEC ❍ F. SRTP
A. HTTPS
C. FTPS
TLS (Transport Layer Security) is a cryptographic protocol used to encrypt network communication. HTTPS is the Hypertext Transfer Protocol over TLS, and FTPS is the File Transfer Protocol over TLS.
An earlier version of TLS is SSL (Secure Sockets Layer). Although we don’t commonly see SSL in use any longer, you may see TLS communication colloquially referenced as SSL.
The incorrect answers:
B. SSH
SSH (Secure Shell) can use symmetric or asymmetric encryption, but those
ciphers are not associated with TLS.
D. SNMPv2
SNMPv2 (Simple Network Management Protocol version 2) does not
implement TLS, or any encryption, within the network communication.
E. DNSSEC
DNSSEC (DNS security extensions) do not provide any confidentiality
of data.
F. SRTP
SRTP (Secure Real-time Transport Protocol) is a VoIP (Voice over IP)
protocol used for encrypting conversations. SRTP protocol commonly uses
AES (Advanced Encryption Standard) for confidentiality.
More information:
SY0-501, Objective 2.6 - Secure Protocols
Which of these threat actors would be MOST likely to
attack systems for direct financial gain?
❍ A. Organized crime
❍ B. Hacktivist
❍ C. Nation state
❍ D. Competitor
A. Organized crime
An organized crime actor is motivated by money, and their hacking
objectives are usually based around objectives that can be easily exchanged
for financial capital.
The incorrect answers:
B. Hacktivist
A hacktivist is focused on a political agenda and not commonly on a
financial gain.
C. Nation state
Nation states are already well funded, and their primary objective is not
usually based on revenue or income.
D. Competitor
A competitor doesn’t have any direct financial gain by disrupting a
website or stealing customer lists, and often their objective is to disable
a competitor’s business or to harm their reputation. If there is a financial
gain, it would often be an indirect result of an attack.
More information:
SY0-501, Objective 1.3 - Threat Actors
A security incident has occurred on a file server. Which of the following data sources should be gathered to address file storage volatility? (Select TWO) ❍ A. Partition data ❍ B. Kernel statistics ❍ C. ROM data ❍ D. Temporary file systems ❍ E. Process table
A. Partition data
D. Temporary file systems
Both temporary file system data and partition data are part of the file
storage subsystem.
An IPS at your company has found a sharp increase in
traffic from all-in-one printers. After researching, your
security team has found a vulnerability associated with
these devices that allows the device to be remotely
controlled by a third-party. Which category would BEST
describe these devices?
❍ A. IoT
❍ B. RTOS
❍ C. MFD
❍ D. SoC
C. MFD
An all-in-one printer that can print, scan, and fax is often categorized as an
MFD (Multifunction Device).
The incorrect answers:
A. IoT
Wearable technology and home automation devices are commonly called
IoT (Internet of Things) devices.
B. RTOS
RTOS (Real-time Operating Systems) are commonly used in manufacturing
and automobiles.
D. SoC
Multiple components that run on a single chip are categorized as an SoC
(System on a Chip).
More information:
SY0-501, Objective 3.5 - Embedded Systems
Which of the following would attempt to exploit a
vulnerability associated with a specific application?
❍ A. Vulnerability scan
❍ B. Active reconnaissance
❍ C. Penetration test
❍ D. Port scan
C. Penetration test
A penetration test is used to determine if a system or application can be
exploited. This process actively attempts to break into a system as part of
the testing.
The incorrect answers:
A. IoT
Wearable technology and home automation devices are commonly called
IoT (Internet of Things) devices.
B. RTOS
RTOS (Real-time Operating Systems) are commonly used in manufacturing
and automobiles.
D. SoC
Multiple components that run on a single chip are categorized as an SoC
(System on a Chip).
More information:
SY0-501, Objective 3.5 - Embedded Systems
Elizabeth, a security administrator, is concerned about
the potential for data exfiltration using external storage
drives. Which of the following would be the BEST way to
prevent this method of data exfiltration?
❍ A. Create an operating system security policy to
prevent the use of removable media
❍ B. Monitor removable media usage in host-based
firewall logs
❍ C. Only whitelist applications that do not use
removable media
❍ D. Define a removable media block rule in the UTM
A. Create an operating system security policy to
prevent the use of removable media
Removable media uses hot-pluggable interfaces such as USB to connect
storage drives. A security policy in the operating system can prevent any
files from being written to a removable drive.
The incorrect answers:
B. Monitor removable media usage in host-based firewall logs
A host-based firewall monitors traffic flows and does not commonly log
hardware or USB drive access.
C. Only whitelist applications that do not use removable media
File storage access options are not associated with applications, so it’s not
possible to whitelist based on external storage drive usage.
D. Define a removable media block rule in the UTM
A UTM (Unified Threat Manager) watches traffic flows across the network
and does not commonly manage the storage options on individual
computers.
More information:
SY0-501, Objective 2.4 - Analyzing Security Output
Tayla is a help desk administrator for a major
transportation company. Her help desk has suddenly
been overwhelmed by phone calls from customers. The
customers are complaining that their browser is giving a
message that the company’s website is untrusted. Which
of the following would be the MOST likely reason for
this issue?
❍ A. The web server is not running the latest
version of software
❍ B. The corporate firewall is misconfigured
❍ C. A content filter is blocking web server traffic
❍ D. The web server has a certificate issue
D. The web server has a certificate issue
Any web server issues relating to trust are generally associated with the
status of the web server certificate. If a certificate has expired or the fullyqualified
domain name on the certificate does not match the name of the
web server, the end users will see errors in their browser.
The incorrect answers:
A. The web server is not running the latest version of software
Web server software should certainly be upgraded when appropriate, but
outdated software would not commonly cause problems with trusting
encrypted communication from a browser.
B. The corporate firewall is misconfigured
A firewall would be expected to either block or allow traffic to the web
server. In this example, the issue is related to the trust between a browser
and web server.
C. A content filter is blocking web server traffic
Content filters would allow or block certain types of web pages, and do not
commonly cause issues with web server trust.
More information:
SY0-501, Objective 2.3 - Common Security Issues
An insurance company has created a set of policies to
handle data breaches. The security team has been given
this set of requirements based on these policies:
• Access records from all devices must be
saved and archived
• Any data access outside of normal working hours
must be immediately reported
• Data access must only occur inside of the country
• Access logs and audit reports must be created from a
single database
Which of the following should be implemented by the
security team to meet these requirements?
(Select THREE)
❍ A. Restrict login access by IP address and
GPS location
❍ B. Require government-issued identification
during the onboarding process
❍ C. Add additional password complexity for accounts
that access data
❍ D. Conduct monthly permission auditing
❍ E. Consolidate all logs on a SIEM
❍ F. Archive the encryption keys of all disabled accounts
❍ G. Enable time-of-day restrictions on the
authentication server
A. Restrict login access by IP address and
GPS location
E. Consolidate all logs on a SIEM
G. Enable time-of-day restrictions on the
authentication server
Adding location-based policies will prevent direct data access from outside
of the country. Saving log information from all devices and creating audit
reports from a single database can be implemented through the use of a
SIEM (Security Information and Event Manager). Adding a check for the
time-of-day will report any access that occurs during non-working hours.
The incorrect answers:
B. Require government-issued identification during the onboarding process
Requiring proper identification is always a good idea, but it’s not one of the
listed requirements.
C. Add additional password complexity for accounts that access data
Additional password complexity is another good best practice, but it’s not
part of the provided requirements.
D. Conduct monthly permission auditing
No requirements for ongoing auditing were included in the requirements,
but ongoing auditing is always an important consideration.
F. Archive the encryption keys of all disabled accounts
If an account is disabled, there may still be encrypted data that needs to be
recovered later. Archiving the encryption keys will allow access to that data
after the account is no longer in use.
More information:
SY0-501, Objective 4.4 - Account Management
Rodney, a security engineer, is viewing this record from
the firewall logs:
UTC 04/05/2018 03:09:15809 AV Gateway Alert
136.127.92.171 80 -> 10.16.10.14 60818
Gateway Anti-Virus Alert:
XPACK.A_7854 (Trojan) blocked.
Which of the following can be observed from this
log information?
❍ A. The victim’s IP address is 136.127.92.171
❍ B. A download was blocked from a web server
❍ C. A botnet DDoS attack was blocked
❍ D. The Trojan was blocked, but the file was not
B. A download was blocked from a web server
A traffic flow from a web server port number (80) to a device port (60818)
indicates that this traffic flow originated on port 80 of the web server. A
file download is one of the most common ways to deliver a Trojan, and this
log entry shows that the file containing the XPACK.A_7854 Trojan was
blocked.
The incorrect answers:
A. The victim’s IP address is 136.127.92.171
The format for this log entry uses an arrow to differentiate between the
attacker and the victim. The attacker IP address is 136.127.92.171, and the
victim’s IP address is 10.16.10.14.
C. A botnet DDoS attack was blocked
A botnet attack would not commonly include a Trojan horse as part of a
distributed denial of service (DDoS) attack.
D. The Trojan was blocked, but the file was not
A Trojan horse attack involves malware that is disguised as legitimate
software. The Trojan malware and the file are the same entity, so there isn’t
a way to decouple the malware from the file.
More information:
SY0-501, Objective 2.4 - Analyzing Security Output
Richard, an engineer, has been posting pictures of a
not-yet-released company product on an online forum.
Richard believed the forum was limited to a small group,
but his pictures were actually posted on a publicly
accessible area of the site. Which of the following
company policies should be discussed with Richard?
❍ A. Personal email
❍ B. Unauthorized software
❍ C. Social media
❍ D. Certificate issues
C. Social media
Most organizations have formal policies on managing social media
engagements, and those policies would most likely prevent someone from
disclosing any pre-release information to the public.
The Answer: C. Social media
Most organizations have formal policies on managing social media
engagements, and those policies would most likely prevent someone from
disclosing any pre-release information to the public.
The incorrect answers:
A. Personal email
This issue was related to postings on an online forum, and no personal
email messages were included with the forum posts.
B. Unauthorized software
No additional or unauthorized software appears to have been used by
Richard to post these pictures on a forum.
D. Certificate issues
A web server certification issue would commonly cause problems with
encryption between a client and a web server. This question doesn’t
include any certificate errors.
More information:
SY0-501, Objective 2.3 - Common Security Issues
A group of universities sponsor a monthly speaking event
that is attended by faculty from many different schools.
Each month, a different university is selected to host
the event. The IT staff for the event would like to allow
access to the local wireless network using the faculty
member’s normal authentication credentials. These
credentials should properly authenticate, even when the
faculty member is not physically located at their home
campus. Which of the following authentication methods
would be the BEST choice for this requirement?
❍ A. RADIUS federation
❍ B. 802.1X
❍ C. PEAP
❍ D. EAP-FAST
A. RADIUS federation
RADIUS (Remote Authentication Dial-In User Service) with federation
would allow members of one organization to authenticate using the
credentials of another organization.
The incorrect answers:
B. 802.1X
802.1X is a useful authentication protocol, but it needs additional
functionality to authenticate across multiple user databases.
C. PEAP
PEAP (Protected Extensible Authentication Protocol) provides a method of
authentication over a protected TLS (Transport Layer Security) tunnel, but
it doesn’t provide the federation needed for these requirements.
D. EAP-FAST
EAP-FAST (Extensible Authentication Protocol - Flexible Authentication
via Secure Tunneling) is an updated version of LEAP (Lightweight EAP)
that was commonly used after WEP (Wired Equivalent Privacy) was
replaced with WPA (Wi-Fi Protected Access).
More information:
SY0-501, Objective 2.3 - Common Security Issues
A system administrator, Daniel, is working on a contract
that will specify a minimum required uptime for a set of
Internet-facing firewalls. Daniel needs to know how often
the firewall hardware is expected to fail between repairs.
Which of the following would BEST describe
this information?
❍ A. MTBF (Mean Time Between Failures)
❍ B. RTO (Recovery Time Objectives)
❍ C. MTTR (Mean Time to Restore)
❍ D. MTTF (Mean Time to Failure)
A. MTBF
The MTBF (Mean Time Between Failures) is a prediction of how often a repairable system will fail.
The incorrect answers:
B. RTO
RTO (Recovery Time Objectives) define a set of objectives needed to
restore a particular service level.
C. MTTR
MTTR (Mean Time to Restore) is the amount of time it takes to repair a
component.
D. MTTF
MTTF (Mean Time to Failure) is the expected lifetime of a non-repairable
product or system.
More information:
SY0-501, Objective 5.2 - Business Impact Analysis
An attacker calls into a company’s help desk and pretends
to be the director of the company’s manufacturing
department. The attacker states that they have forgotten
their password and they need to have the password reset
quickly for an important meeting. The help desk engineer
requests the employee’s ID number and sends a password
reset validation code to the user’s registered mobile
device number. What kind of attack is the help desk
engineer preventing by following these processes?
❍ A. Social engineering
❍ B. Tailgating
❍ C. Vishing
❍ D. Man-in-the-middle
A. Social engineering
A social engineering attack takes advantage of authority and urgency
principles in an effort to convince someone else to circumvent normal
security controls.
The incorrect answers:
B. Tailgating
A tailgating attack follows someone else with proper credentials through a
door. This allows the attack to gain access to an area that’s normally locked.
C. Vishing
Vishing (voice phishing) attacks use the phone to obtain private
information from others. In this example, the attacker was not asking for
confidential information.
D. Man-in-the-middle
A man-in-the-middle attack commonly occurs without any knowledge to
the parties involved, and there’s usually no additional notification that an
attack is underway. In this question, the attacker contacted the help desk
engineer directly.
More information:
SY0-501, Objective 1.2 - Principles of Social Engineering
A security administrator has been using EAP-FAST
wireless authentication since the migration from WEP
to WPA2. The company’s network team now needs to
support additional authentication protocols inside of an
encrypted tunnel. Which of the following would meet the
network team’s requirements?
❍ A. EAP-TLS (Extensible Authentication Protocol - Transport Layer Security)
❍ B. PEAP (Protected Extensible Authentication Protocol)
❍ C. EAP-TTLS (Extensible Authentication Protocol - Tunneled Transport Layer Security)
❍ D. EAP-MSCHAPv2 (EAP - Microsoft Challenge Handshake Authentication Protocol v2)
C. EAP-TTLS
EAP-TTLS (Extensible Authentication Protocol - Tunneled Transport Layer
Security) allows the use of multiple authentication protocols transported
inside of an encrypted TLS (Transport Layer Security) tunnel. This allows
the use of any authentication while maintaining confidentiality with TLS.
The incorrect answers:
A. EAP-TLS
EAP-TLS does not provide a mechanism for using multiple authentication
types within a TLS tunnel.
B. PEAP
PEAP (Protected Extensible Authentication Protocol) encapsulates EAP
within a TLS tunnel, but does not provide a method of encapsulating other
authentication methods.
D. EAP-MSCHAPv2
EAP-MSCHAPv2 (EAP - Microsoft Challenge Handshake Authentication
Protocol v2) is a common implementation of PEAP.
More information:
SY0-501, Objective 6.3 - Wireless Authentication Protocols
Which of the following would be commonly provided
by a CASB? (Select TWO)
❍ A. List of all internal Windows devices that have not
installed the latest security patches
❍ B. List of applications in use
❍ C. Centralized log storage facility
❍ D. List of network outages for the previous month
❍ E. Verification of encrypted data transfers
❍ F. VPN connectivity for remote users
B. A list of applications in use
E. Verification of encrypted data transfers
A CASB (Cloud Access Security Broker) can be used to apply security policies to cloud-based implementations. Two common functions of a CASB are visibility into application use and data security policy use. Other common CASB functions are the verification of compliance with formal standards and the monitoring and identification of threats.
The incorrect answers:
A. List of all internal Windows devices that have not installed the latest
security patches
A CASB focuses on policies associated with cloud-based services and not
internal devices.
C. Centralized log storage facility
Using Syslog to centralize log storage is most commonly associated with a
SIEM (Security Information and Event Manager).
D. List of network outages for the previous month
A network availability report would be outside the scope of a CASB.
F. VPN connectivity for remote users
VPN concentrators are commonly used to provide security connectivity for
remote users.
More information:
SY0-501, Objective 3.7 - Security in the Cloud
The embedded OS in a company’s time clock appliance is
configured to reset the file system and reboot when a file
system error occurs. On one of the time clocks, this file
system error occurs during the startup process and causes
the system to constantly reboot. This loop continues until
the time clock is powered down. Which of the following
BEST describes this issue?
❍ A. DLL injection
❍ B. Resource exhaustion
❍ C. Race condition
❍ D. Weak configuration
C. Race condition
A race condition occurs when two processes occur at similar times, usually
with unexpected results. The file system problem is usually fixed before
a reboot, but a reboot is occurring before the fix can be applied. This has
created a race condition that results in constant reboots.
The incorrect answers:
A. DLL injection
One method of exploiting an application is to take advantage of the
libraries reference by the application rather than the application itself.
DLL (Dynamic Link Library) injection manipulates the library as the attack
vector.
B. Resource exhaustion
If the time clock was running out of storage space or memory, it would
most likely be unusable. In this example, the issue isn’t based on a lack of
resources.
D. Weak configuration
If the system is poorly configured, there may be unintended access to a
service or data. This time clock issue wasn’t related to any misconfiguration
or weak configuration on the time clock appliance.
More information:
SY0-501, Objective 1.6 - Vulnerability Types
A recent audit has found that existing password policies
do not include any restrictions on password attempts,
and users are not required to periodically change their
passwords. Which of the following would correct these
policy issues? (Select TWO)
❍ A. Password complexity
❍ B. Password expiration
❍ C. Password history
❍ D. Password lockout
❍ E. Password recovery
B. Password expiration
D. Password lockout
Password expiration would require a new password after the expiration
date. Password lockout would disable an account after a predefined
number of unsuccessful login attempts.
The incorrect answers:
A. Password complexity
A complex password would make it more difficult to brute force, but it
would not solve the issues listed in this question.
C. Password history
Having a password history would prevent the reuse of any previous
passwords.
E. Password recovery
The password recovery process provides a method for users to recover an
account that has been locked out or has a forgotten password.
More information:
SY0-501, Objective 4.4 - Account Policy Enforcement
What kind of security control is associated with a login banner? ❍ A. Preventive ❍ B. Deterrent ❍ C. Corrective ❍ D. Detective ❍ E. Compensating ❍ F. Physical
B. Deterrent
A deterrent control does not directly stop an attack, but it may discourage
an action.
The incorrect answers:
A. Preventive
A preventive control physically limits access to a device or area.
C. Corrective
A corrective control can actively work to mitigate any damage.
D. Detective
A detective control may not prevent access, but it can identify and record
any intrusion attempts.
E. Compensating
A compensating security control doesn’t prevent an attack, but it does
restore from an attack using other means.
F. Physical
A physical control is real-world security, such as a fence or door lock.
More information:
SY0-501, Objective 5.7 - Security Controls
Your security team has been provided with an
uncredentialed vulnerability scan report created by a
third-party. Which of the following would you expect to
see on this report?
❍ A. A summary of all files with invalid group
assignments
❍ B. A list of all unpatched operating system files
❍ C. The version of web server software in use
❍ D. A list of local user accounts
C. The version of web server software in use
A scanner like Nmap can query services and determine version numbers
without any special rights or permissions, which makes it well suited for
non-credentialed scans.
The incorrect answers:
A. A summary of all files with invalid group assignments
Viewing file permissions and rights requires authentication to the
operating system, so you would not expect to see this information if the
scan did not have credentials.
B. A list of all unpatched operating system files
Viewing detailed information about the operating system files requires
authentication to the OS, and an uncredentialed scan does not have those
permissions.
D. A list of local user accounts
Local user accounts are usually protected by the operating system, so you
would need to have credentials to view this information.
More information:
SY0-501, Objective 1.5 - Vulnerability Scanning
The security team of a small manufacturing company
is investigating a compromised server that resulted in a
defaced internal website home page. The web server had
been running for a year, but no security patches were ever
applied. Logs from the web server show a large number
of attacks containing well-known exploits occurred just
before the server was defaced. Which of these would be
the MOST likely source of this attack?
❍ A. Hacktivist
❍ B. Script kiddie
❍ C. Insider
❍ D. Nation state
B. Script kiddie
A script kiddie commonly runs pre-made scripts without any knowledge of
what the script is actually doing. The script kiddie is simply hoping that at
least one of the many exploit attempts will be successful.
The incorrect answers:
A. Hacktivist
A hacktivist often uses sophisticated attacks in an effort to address a
particular political agenda or worldview. An attack of an internal web
server would have a limited scope and reach, and the large number of
exploit attempts would seem to show a lack of sophistication.
C. Insider
Insiders usually have enhanced rights and permissions and don’t need to
use a script or exploit a vulnerability.
D. Nation state
Nation states are focused on attacking governments and large entities.
Defacing a website home page would not be a common objective of a
nation state.
More information:
SY0-501, Objective 1.3 - Threat Actors
Which of these would be MOST significant security
concern for an insider threat?
❍ A. Passwords written on sticky notes
❍ B. An unpatched file server
❍ C. A VPN concentrator that uses an older
encryption cipher
❍ D. Limited bandwidth available on the Internet link
A. Passwords written on sticky notes
A password written down and left in an open area can be used by any
insider who happens to walk by.
The incorrect answers:
B. An unpatched file server
Insider threats usually have access to more resources than those outside of
the organization, so identifying and exploiting an open vulnerability isn’t
usually necessary.
C. A VPN concentrator that uses an older encryption cipher
Internal users already have access to the inside of the network, so issues
on the VPN (Virtual Private Networking) concentrator aren’t usually
considered to be a concern as an insider threat.
D. Limited bandwidth available on the Internet link
A limited amount of bandwidth is useful for an external entity who wants
to perform a denial of service, but that isn’t usually an issue for threats that
are already on the inside.
More information:
SY0-501, Objective 1.3 - Threat Actors
A security administrator would like to limit access from
a user VLAN to the server VLAN. All traffic to the server
VLAN communicates through the core router. Users
should only be able to connect to servers using standard
protocols. Which of the following options would be the
BEST way to implement this security feature?
❍ A. Configure a reverse proxy
❍ B. Define an ACL on the core router
❍ C. Replace the core router with a layer 3 firewall
❍ D. Add a load balancer for each server cluster
B. Define an ACL on the core router
Configuring an ACL (Access Control List) is a feature already included with
the router. The ACL will allow the filtering of traffic by IP address and port
number.
The incorrect answers:
A. Configure a reverse proxy
Although a proxy may provide some additional security functionality, the
installation and configuration of a reverse proxy is unnecessary if all you
need is a relatively simple protocol filtering mechanism.
C. Replace the core router with a layer 3 firewall
A firewall would certainly provide the filtering required for this scenario,
but it would require additional cost, installation, and time to implement.
The filtering functionality described in the question is already available in
the existing core router.
D. Add a load balancer for each server cluster
Adding load balancing to your servers would provide additional fault
tolerance to your server farm, but it is not commonly used for traffic
filtering. The load balancer would also require a purchase and require
additional network configurations.
More information:
SY0-501, Objective 2.1 - Router and Switch Security
A file server has a full backup performed each Monday
at 1 AM. Incremental backups are performed at 1 AM on
Tuesday, Wednesday, Thursday, and Friday. The system
administrator needs to perform a full recovery of the file
server on Thursday afternoon. How many backup sets
would be required to complete the recovery?
❍ A. 2
❍ B. 3
❍ C. 4
❍ D. 1
C. 4
Each incremental backup will archive all of the files that have changed
since the last full or incremental backup. To complete this full restore, the
administrator will need the full backup from Monday and the incremental
backups from Tuesday, Wednesday, and Thursday.
The incorrect answers:
A. 2
If the daily backup was differential, the administrator would only need the
full backup and the differential backup from Thursday.
B. 3
Since the incremental backup only archives files that have changed, he will
need all three daily incremental backups as well as Monday’s full backup.
D. 1
To recover incremental backups, you’ll need the full backup and all
incremental backups since the full backup.
More information:
SY0-501, Objective 5.6 - Application Recovery
