A team tells you backups run nightly and are retained for 30 days. What is missing from that answer?

What the interviewer is testing

Whether you know that a backup is not a control until it has been restored — one of the most reliable ways to find an unrecovered gap in a production estate.

What is missing

1. Has a restore ever been performed? The only question that matters. An untested backup is a hypothesis. The regular findings when someone finally tries: the backup excluded a schema, the restore takes eleven hours against a four-hour RTO, the encryption key is stored in the system being restored, or nobody has ever run the procedure and the documentation is three years stale.

2. What is the actual RPO? "Nightly" means up to 24 hours of data loss. Is that the agreed RPO, or is it just the schedule somebody set? If the business needs one hour, nightly backups are not the mechanism — point-in-time recovery with continuous log archiving is.

3. What is the actual RTO? Time to usable service, not time to copy bytes: provision the target, restore, replay logs, validate, repoint the application, warm caches. Measure it, do not estimate it.

4. What exactly is backed up? Databases usually are. Frequently not: object storage, secrets and keys, configuration, IAM policies, infrastructure definitions, message queue contents, and the third-party SaaS holding critical data. A restore that recovers the database into an environment that no longer exists is not a recovery.

5. Where are they, and can the same credential delete them? This is the ransomware question. A backup in the same account, reachable by the same credentials that manage production, is deleted by the same attacker or the same mistake. Backups need to be in a separate account or subscription, ideally immutable (object lock / write-once), with a separate identity path.

6. Are restores monitored, and are backups verified? Backup jobs fail silently more often than anyone expects. Alert on backup success, not on failure — a job that stopped running produces no failures at all.

The rule worth stating

3-2-1: three copies, on two media or storage classes, one off-site or in a separate account. Modernised, the essential part is that at least one copy is outside the blast radius of both an attacker and an operator error in the primary environment.

What a strong answer adds

Proposing a scheduled restore drill — quarterly, to a clean environment, timed, with the result compared to the stated RTO — treated as a compliance obligation rather than as something to do when there is spare capacity. And noting that the drill is also the only honest way to keep the runbook current.