A regulator asks the security team to prove that a stolen copy of the FMC backup is unreadable without a secret the administrators keep offline, and that one restore point rebuilds the access-control policies, objects, and device registrations. The team currently copies the backup file to a file server after every change. Which FMC backup practice satisfies both requirements?

Cisco documents FMC backups as unencrypted archive files, so FMC has no backup passphrase setting; to make a stolen copy unreadable, you must encrypt the archive yourself with a key the administrators keep offline. A complete FMC configuration backup is the single restore point for access-control policies, objects, and device registrations, so encrypting that archive with an offline-held key meets both requirements. Protecting policy and object exports with an offline key does not provide a single restore point for everything, because device registrations must be rebuilt from a separately maintained inventory. Encrypting a complete backup with a key in an online secrets vault provides the right backup scope, but the key is not kept offline as required. Encrypting complete backups with an offline key protects confidentiality, but restoring matching components from separate dated recovery sets depends on multiple restore points rather than one. Exam caveat: confirm the release’s backup scope and restore rules; restores generally require the same software version. Practical check: decrypt a copy using only the offline key in an isolated lab, restore it, and verify the policies, objects, and device registrations.