After ransomware hits a department file share, the whole share must be recovered, while a separate ticket only needs one mailbox returned. What recovery capability distinction should the backup design support?
Select an answer to reveal the explanation.
Short Explanation
Sometimes you need the whole warehouse back; sometimes you just need one labeled box. Bulk restores cover the warehouse; granular restores pull the single mailbox.
Full Explanation
Backup architectures should support bulk recovery when large datasets or entire shares are lost, and granular recovery when only a single item such as one mailbox must return. After ransomware hits a department file share, whole-share restore is required, while a separate help-desk ticket may need only one mailbox—designing for both capabilities avoids forcing destructive all-or-nothing restores for small requests and avoids slow manual salvage for mass loss. Municipal departments generate both incident types routinely.
Only image-level restores that always rebuild every cluster node over-prescribe infrastructure rebuild for file/mailbox problems. Granular recovery only is insufficient when ransomware destroys an entire share. Manual retyping from paper forms is not a scalable backup strategy for modern civic collaboration systems.
Exam caveat: granularity is a restore feature requirement, not a reason to skip image or VM-level backups. Many platforms need both image backups and application-aware or item-level options.
Operational check: test a full file-share restore into a sandbox and a single-mailbox restore from the same or complementary backup product, measure durations, and map each ticket type to the correct runbook. Ensure ransomware playbooks state which backup immutable/offline copy is authoritative for bulk recovery.