Cloud Backup and Recovery Interview Questions and Answers for Cloud and Infrastructure Roles

Key takeaways

• Start every design answer with RPO and RTO, because they drive cost and method.
• Snapshots help quick recovery but are not a complete backup strategy by themselves.
• Immutable and offline copies protect against ransomware and accidental deletion.
• Encrypt backups and control who can delete them.
• Test restores on a schedule and record the time taken.

Core concepts

1. What are RPO and RTO?

RPO (recovery point objective) is the most data loss you accept, measured in time. RTO (recovery time objective) is the longest acceptable time to restore service. Shorter targets cost more.

2. What is the difference between backup and replication?

Replication copies changes continuously for availability, but it also copies corruption and deletions. A backup is a point-in-time copy you can roll back to.

3. What is the 3-2-1 rule?

Keep three copies of data, on two different types of storage, with one copy off-site. Many teams extend it with an immutable or offline copy.

4. What is the difference between a snapshot and a backup?

A snapshot records state at a moment, often on the same storage system. A backup is stored independently, so it survives loss of the original system or account.

5. Full, incremental and differential backups: what is the difference?

Full copies everything. Incremental copies changes since the last backup of any type. Differential copies changes since the last full backup. Restores need the full plus the required incrementals or the latest differential.

6. What is a backup window?

The period in which backups run without hurting production performance. Incremental backups and snapshots help shorten it.

7. What is a retention policy?

Rules for how long backups are kept, based on business need and legal requirements. Longer retention costs more storage.

Cloud design

8. How do you back up a virtual machine in the cloud?

Use the provider's backup service or scheduled disk snapshots, with a policy for frequency and retention, tags to select machines, and a copy to another region or account for resilience.

9. How do you back up a managed database?

Enable automated backups and point-in-time recovery, set retention, take manual snapshots before risky changes, and test a restore into a new instance.

10. What is cross-region backup and why use it?

Copying backups to another region protects against a regional outage. Consider data residency rules and transfer costs.

11. Why use a separate account or subscription for backups?

If an attacker or a mistake compromises the production account, a separate backup account with restricted access keeps the copies safe.

12. How do you back up object storage?

Turn on versioning, add lifecycle rules and replicate to another bucket or region. Use object lock where write-once retention is needed.

13. How do you back up containers and Kubernetes?

Back up persistent volumes and cluster state such as manifests and etcd, and keep configuration in Git. Containers themselves are rebuilt from images.

14. How do you protect SaaS data such as email and documents?

SaaS providers run the service, but you remain responsible for your data. Use a third-party or built-in backup with a defined retention period.

Security

15. What is an immutable backup?

A backup that cannot be changed or deleted for a set period, often using write-once retention such as object lock. It protects against ransomware and malicious deletion.

16. How do you encrypt backups?

Use encryption at rest with keys in a key management service, and TLS in transit. Protect and back up the keys separately, because losing them means losing the data.

17. Who should be allowed to delete backups?

Very few people, with multi-person approval or delay where possible. Apply least privilege and log all backup and restore actions.

18. How do backups help against ransomware?

Clean, immutable, tested backups let you restore without paying. Keep at least one copy that production credentials cannot reach.

Recovery and testing

19. How do you test a restore?

Restore into an isolated environment, check data integrity and application function, and record how long it took against the RTO. Repeat on a schedule and after major changes.

20. What is the difference between backup and disaster recovery?

Backup protects data. Disaster recovery restores the whole service, including infrastructure, networking and access, within agreed targets.

21. What are common disaster recovery patterns?

Backup and restore, pilot light, warm standby and active-active. They trade cost against recovery speed.

22. What is point-in-time recovery?

Restoring a database to a chosen moment using a base backup plus transaction logs, for example just before an accidental deletion.

23. How do you monitor backups?

Alert on failed or missed jobs, track size and duration trends, and report on restore test results. Silent failures are the usual cause of surprise data loss.

24. How do you control backup cost?

Match retention to need, use storage tiers, exclude temporary data, deduplicate and review unused backups regularly.

25. What would you check first if a restore fails?

Check the job logs and error code, backup integrity, permissions, encryption keys, free space and whether the backup is from a compatible version.

Worked example: restoring a deleted database table

1. Confirm the time of the accidental change, and stop further writes if needed.
2. Choose the restore point just before it, using point-in-time recovery.
3. Restore into a new instance, not over production.
4. Export the missing table from the restored copy and import it into production, or switch applications to the new instance.
5. Check row counts and application behaviour, then record the steps and timing.
6. Delete the temporary instance and update the runbook.

Common mistakes

• Never testing a restore.
• Keeping backups in the same account and region as production.
• Forgetting encryption keys and credentials in the recovery plan.
• Treating replication as backup.

Next steps

Practise backup labs in the AWS training or the Azure administrator course. Related reading: cloud disaster recovery interview questions and cloud storage interview questions.