One common configuration is to have a non-voting, hidden backup node. One would then take e.g. hourly filesystem or EBS snapshots of the node. One potential issue with this approach is that it's possible that a backup snapshot might wind up with data that is rolled back, e.g. if the primary fails at the same time a s apshot is taken. One approach to address this is to use delayed replication of e.g. 5 min, and hope that is sufficient to avoid observing the rollback (I'm not sure of the oplog is fixed up during a rollback or not, so perhaps this isn't actually sufficient). Instead, a more robust solution would be to allow the backup node's replication thread/query to use read concern majority. Presumably this would require that you set the node to priority 0/hidden, the same restrictions on delayed replication.