Exercise 3: Why RAID 10 Didn't Protect Against Ransomware — Possible Solution ==================================================================== Explanation: Per the chapter's own warn-box, "RAID protects against a physical disk failing, nothing more. It does nothing against accidental deletion, ransomware, or a filesystem-level bug -- any of those get written identically and consistently to every disk in the array, redundancy and all." This is exactly what happened to the team: the ransomware ran as a normal, legitimate write operation from the perspective of the RAID array itself -- it opened each file and wrote new, encrypted content in its place, the same way any ordinary application write would. RAID 10's own mirroring mechanism, per the chapter, works by keeping paired disks as exact duplicates of each other -- every write to the array gets written to both disks in a mirrored pair. This mechanism doesn't distinguish a legitimate application write from a malicious one; it simply mirrors whatever gets written, faithfully and immediately. When the ransomware encrypted each file in place, that encrypted, unreadable version was mirrored across every pair in the array exactly as reliably as any normal write would have been -- RAID 10's own redundancy mechanism is precisely what guaranteed the corrupted, encrypted data ended up consistently and completely replicated everywhere in the array, not held back or protected anywhere. RAID's actual protection is against a disk physically failing -- losing an array member due to hardware failure, which mirroring or parity can reconstruct from the surviving disks. It was never designed to distinguish good data from bad data at the content level, only to preserve whatever data it's given across a hardware failure. The team's mistake was treating "redundant" as synonymous with "protected against any kind of loss," when the chapter is explicit that a real backup on genuinely separate storage -- not just another disk in the same array -- is what actually protects against this class of incident. WHY THIS WORKS AS AN ANSWER ------------------------------ This explains the actual mechanism (RAID mirrors whatever is written without judging its legitimacy, so ransomware's malicious writes get faithfully replicated too) rather than just citing "RAID isn't a backup" as a rule, and names what RAID does protect against by contrast (physical disk failure) to make the distinction concrete.