Book an info sessionInfo session

Firewalls: stateful vs stateless, UTM, NGFW, WAF, DMZ architecture

CompTIA Network+ Preparation · lesson 24 of 30 · 25 min

High Availability Concepts

High Availability (HA) — designing systems to minimize downtime. Measured as a percentage of uptime. “Five nines” (99.999%) = ~5 minutes downtime per year.

SPOF (Single Point of Failure) — any component whose failure brings down the entire system. HA design eliminates SPOFs through redundancy.

Redundancy — duplicate components so failure of one does not cause an outage. Applies to power supplies, NICs, switches, links, ISPs, and data centers.

Load balancing — distributes traffic across multiple servers. Improves performance and provides redundancy. If one server fails, others handle the load. Methods: round-robin, least connections, IP hash.

Clustering — multiple servers working together as one. Active-active: all nodes handle traffic. Active-passive: standby node takes over on failure.

NIC teaming (bonding) — combining multiple NICs for redundancy and/or increased bandwidth. LACP (802.3ad) is the standard protocol for link aggregation.

Disaster Recovery Metrics

RTO (Recovery Time Objective) — maximum acceptable time to restore a system after a failure. “How long can we be down?” Lower RTO = more expensive solution.

RPO (Recovery Point Objective) — maximum acceptable data loss measured in time. “How much data can we afford to lose?” RPO of 1 hour means backups every hour.

MTTR (Mean Time to Repair) — average time to restore a failed component. Lower is better.

MTBF (Mean Time Between Failures) — average time between failures. Higher is better — indicates reliability.

Backup and Recovery Sites

Hot site — fully operational duplicate data center with live data replication. Can take over in minutes. Most expensive.

Warm site — has hardware and connectivity but data must be restored from backup. Recovery takes hours to days. Moderate cost.

Cold site — empty facility with power and connectivity only. Hardware must be installed and data restored. Recovery takes days to weeks. Cheapest.

Backup types:

Full backup — copies all data. Slowest to create, fastest to restore.

Incremental backup — copies only data changed since the last backup (full or incremental). Fastest to create, slowest to restore (need full + all incrementals).

Differential backup — copies all data changed since the last full backup. Moderate create time, faster restore than incremental (need full + latest differential only).

Exam Tip

RTO = downtime tolerance. RPO = data loss tolerance. Hot site = minutes to recover. Cold site = days. Incremental = fastest backup, slowest restore. Differential = moderate backup, faster restore than incremental.

Key Terms

Key Terms

Knowledge Check — 10 Questions

Network+ — Availability and DR

RTO defines:

  • How much data can be lost
  • Maximum acceptable downtime after a failure
  • Average time between failures
  • Time to complete a backup
  • Answer: Maximum acceptable downtime after a failure

RTO = Recovery Time Objective — how long the business can tolerate being down. Lower RTO requires more expensive HA solutions. RPO of 4 hours means:

  • Systems must be restored within 4 hours
  • Backups must occur at least every 4 hours
  • The system has 4 hours of battery backup
  • MTTR must be under 4 hours
  • Answer: Backups must occur at least every 4 hours

RPO = Recovery Point Objective — maximum data loss tolerance. RPO of 4 hours means you can lose at most 4 hours of data, so backups every 4 hours. A hot site can restore operations in:

  • Days to weeks
  • Hours to days
  • Minutes
  • Seconds only
  • Answer: Minutes

Hot site = fully operational duplicate with live data replication. Failover can happen in minutes. Most expensive DR option.

Which backup type is fastest to create but slowest to restore?

  • Full
  • Differential
  • Incremental
  • Mirror

Answer: Incremental
Incremental backups only copy changes since the last backup — fast to create. Restore requires the full backup plus every incremental — slow.

LACP (802.3ad) is used for:

  • Wireless authentication
  • Link aggregation / NIC teaming
  • VLAN tagging
  • Spanning tree
  • Answer: Link aggregation / NIC teaming

LACP (Link Aggregation Control Protocol) bundles multiple physical links into one logical link for redundancy and bandwidth. MTBF measures:

  • Time to restore after failure
  • Average time between failures — reliability indicator
  • Time to complete a backup
  • Maximum downtime allowed
  • Answer: Average time between failures — reliability indicator

MTBF = Mean Time Between Failures. Higher MTBF = more reliable component. Used to compare hardware reliability. A cold site provides:

  • Live data replication
  • Pre-installed hardware ready to use
  • Empty facility with power and connectivity only
  • Automatic failover
  • Answer: Empty facility with power and connectivity only

Cold site = empty shell. Hardware must be installed and data restored from backup. Recovery takes days to weeks. Cheapest option. Active-active clustering means:

  • One node is always on standby
  • All nodes actively handle traffic simultaneously
  • Nodes alternate daily
  • Only one node runs at a time
  • Answer: All nodes actively handle traffic simultaneously

Active-active: all cluster nodes handle traffic — better performance and redundancy. Active-passive: standby node only activates on failure. Differential backup copies:

  • All data
  • Only changes since the last full backup
  • Only changes since the last backup of any type
  • Only deleted files
  • Answer: Only changes since the last full backup

Differential: copies everything changed since the last full backup. Restore = full + latest differential only (faster than incremental restore).

Five nines availability (99.999%) allows approximately _____ minutes of downtime per year.

Answer: 5
99.999% uptime = 0.001% downtime. 0.00001 × 525,600 minutes/year ≈ 5.26 minutes. “Five nines” is the gold standard for HA.


Previous lesson: Wireless security threats: evil twin, deauthentication, WPS attacks, rogue APs
Back to CompTIA Network+ Preparation
Next lesson: VPN types: site-to-site, remote access, SSL/TLS, IPsec, split tunneling