Are backups tested by performing restores?

There is a reason this question is phrased around restores rather than backups. An untested backup is a belief, and the failure mode it protects against, discovering at the worst possible moment that the file is empty or the schema has drifted, is common enough that reviewers ask about it specifically.

The honest answer for most small teams is uncomfortable. Backups run automatically, nobody has restored one deliberately, and the closest thing to a test was a production incident that happened to end well. If that is the position, the useful answer says backups run daily with a stated retention, and that restore testing is being formalised. That is weaker than a yes and much stronger than a yes you cannot support, because this is one of the questions a reviewer may come back to with "when was the last one".

Making it a real yes is a small job. A quarterly restore into a scratch environment, with the date and the outcome written down, takes an afternoon to set up and converts this question, permanently, into a confirmed answer. It is one of the highest-value hours on this entire list.

Answer the three things underneath it. Frequency, retention and location. Daily, thirty days, and a different region from production is a normal shape. If your backups sit in the same region as the thing they protect, say so rather than implying geographic separation you do not have: it is a legitimate design choice for many products and an outright misstatement if you claim otherwise.

Point at your recovery objectives if you have them. A restore test means more alongside an RTO and RPO, because it shows the test was measured against something. If your business continuity plan states four hours and one hour, and your last restore took ninety minutes, that is a very strong two-sentence answer.

FillTrust usually grades this as implied, and it is the right grade: your continuity plan almost certainly mentions backups and almost certainly does not mention testing them. That gap is the answer worth writing by hand once, after which it is reused everywhere.