A town hall keeps production VMs and all backup disks in the same on-premises rack. What backup placement best reduces the risk that one rack or site failure destroys production and backups together?
Select an answer to reveal the explanation.
Short Explanation
If the fire takes the whole rack, production and the only backup toast together. An off-site or other-region copy is the spare key you keep at a friend's house.
Full Explanation
Co-locating production VMs and the only backup disks in the same on-premises town-hall rack creates a single failure domain: fire, flood, power event, or rack loss can destroy both live systems and the backups needed to rebuild them. Keeping an off-site or alternate-location backup copy separates those failure domains so a facility disaster does not erase the municipality’s recovery path. Off-site placement is foundational civic resilience for records citizens depend on.
Keeping only same-rack backups because they improve RTO ignores that RTO is meaningless if media are destroyed with production. Storing a second copy on a USB drive left in the same server room drawer still shares the room’s failure domain. Deleting on-site backups and relying solely on application-level undo logs removes durable point-in-time copies and does not replace off-site backup for many disaster classes.
Exam caveat: off-site does not automatically mean "cloud" or "tape courier"—it means a distinct failure domain. The 3-2-1 style thinking (multiple copies, media types, and locations) often appears alongside this concept on exams.
Operational check: inventory where each backup copy lives, confirm at least one copy is outside the production rack/site, perform a restore from the off-site copy into a test environment, and update the town’s disaster-recovery runbook with media locations, encryption key custody, and courier or replication contacts. Revisit placement after any datacenter move.