How do you validate database backups?

Direct answer

What a strong answer covers

How it works

A backup that has never been restored is a hope, not a backup. Validation means restoring it, on a schedule, into an isolated environment, running integrity checks and a sample of application queries against it, and timing the whole procedure to measure the recovery time actually achieved. The backup itself is automated, encrypted, retained according to policy with copies off-site or in another account so an attacker who deletes the primary cannot delete the copies, and its age is monitored so a failed job is noticed the same day. Point-in-time recovery from archived logs is tested separately because it exercises a different path.

Example

A team restores last night’s backup every Monday into a scratch environment, runs a checksum verification and a smoke test that logs in and loads an order, and records the duration; the measured RTO of 35 minutes and RPO of 15 minutes from log shipping go on the service’s reliability page. The first drill found that the backup omitted a schema created after the job was configured, which was fixed before it was needed.

Common mistakes

• Backing up nightly and never restoring.
• Keeping backups in the same account and region where a deletion or a compromise would take them too.
• Measuring RPO from the backup schedule rather than from a tested restore.

A useful answer structure

Answer from your own work.

Do not memorise a script: use only examples you can explain honestly in follow-up questions.