Which Step Must Be Included in a Network Security DR Plan?
Short answer
C Regular data backups are the DR step that restores clean data after a network security incident, while scans, antivirus, and IDS are preventive or detective controls.
Question
Key Takeaways
The exam tests whether you can separate recovery controls from preventive and detective security controls, and the trap is choosing a familiar security tool such as antivirus or IDS because the scenario mentions a security incident.
This N10-009 scenario tests disaster recovery planning for a network security incident. The required DR step is regular data backups (C), because restoration, not prevention or detection, is the core of disaster recovery.
Common mistake: The most tempting wrong answer is B, installing antivirus on all devices, because it sounds like direct incident protection; however, antivirus does not restore encrypted or lost data the way a DR backup does.
Expert Analysis
Decoding the qualifier must The question is not asking for every security control a company should deploy; it asks which step must be included in a disaster recovery plan for a network security incident. DR is about restoring data, systems, and operations after a disruptive event, so the decisive test is whether an option enables recovery to a known-good state. Options that merely prevent, detect, or monitor attacks are incomplete for this wording.
Why backup is correct Option C directly satisfies the recovery requirement. Regular backups provide a clean copy of data that can be restored after ransomware, destructive malware, or another network security incident has compromised production systems. Without a backup and a tested restore path, the company can rebuild infrastructure but cannot reliably recover its data; that is a core DR outcome. The discussion's point that DR focuses on restoring systems, operations, and data after a critical disruption reinforces why C is the only option framed as a recovery step.
Eliminating the controls A, vulnerability scans, is a preventive/detective security activity: it identifies weaknesses so they can be remediated, not a mechanism for restoring operations after an incident. B, antivirus on all devices, is an endpoint protection control that can block or quarantine malware, but it does not guarantee recovery of corrupted, encrypted, or deleted data. D, IDS on all networks, detects suspicious traffic and supports incident response, yet detection alone does not restore service or data. All three can be valuable in a broader security program, but the word must and the DR context rule them out as the required step.
The exam takeaway When an item pairs DR plan with security incident, choose the capability that gets the organization back to a working, clean state. Backups are the concrete recovery primitive; scanning, antivirus, and IDS are supporting controls around it.
Official Reference
These links open the official vendor documentation in a new tab.
Exam Strategy
For DR questions, classify each answer by its role: prevention, detection, response, or recovery. The word must usually points to the recovery capability that restores data and service, not the tool that reduces the chance of an incident. In this question, backups are the only option that restores a clean state after a security event. Apply the same filter when alternate sites, restoration testing, or RTO/RPO appear.
Frequently Asked Questions
Why is regular data backup a DR step rather than just a security control?
Do vulnerability scans and IDS have no place in a security incident plan?
What else should accompany backups in a network DR plan?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
ERB14 👍 1 Answered CBack up all data regularly: A Disaster Recovery (DR) plan focuses on restoring systems, operations, and data following a critical event or disruption (such as ransomware or a severe network security incident). Regular data backups are a fundamental component of DR to ensure data can be restored to a clean state.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All N10-009 Questions
Access 100 questions with complete answers and detailed explanations.
View Full N10-009 Practice Test →