ISC2 CC Practice Test 20 — 15 Questions

Question 1

An organization's recovery time objective (RTO) for its customer database is 4 hours, and the recovery point objective (RPO) is 1 hour. The database is backed up every hour using full backups. A disaster occurs at 2:00 PM, and the last successful backup was at 1:00 PM. The system is restored and operational at 5:30 PM, but data from 1:00 PM to 2:00 PM is lost. Which statement is correct?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Both the RTO and RPO were met.. The RTO (4 hours) was met because recovery took 3.5 hours (2:00 PM to 5:30 PM). The RPO (1 hour) was exceeded because the data loss was 1 hour (consistent with backup frequency), but the question implies the loss is exactly 1 hour; however, the backup at 1:00 PM covers up to that time, and the loss of 1 hour is within the RPO of 1 hour. Actually, the loss is from 1:00 PM to 2:00 PM = 1 hour, which meets the RPO. So both RTO and RPO were met.

Answer

The RTO was met, but the RPO was exceeded.

Answer

The RTO was exceeded, but the RPO was met.

Answer

Both the RTO and RPO were exceeded.

Question 2

A company uses a reciprocal agreement for disaster recovery. What is a primary risk of this strategy?

Accepted Answer

Both organizations may be impacted by the same disaster. In a reciprocal agreement, two organizations agree to host each other's systems. A key risk is that both may be affected by the same disaster (e.g., regional power outage) or that the partner's capacity may be insufficient.

Answer

Data confidentiality issues

Answer

Slow recovery due to lack of equipment

Answer

High cost of maintaining the agreement

Question 3

A healthcare organization experiences a data breach involving protected health information (PHI). Under GDPR, within how many hours must the organization notify the relevant supervisory authority?

Accepted Answer

72 hours. GDPR requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach.

Answer

24 hours

Answer

48 hours

Answer

7 days

Question 4

A company has a Recovery Point Objective (RPO) of 1 hour for its financial database. It performs full backups every night at 11 PM and incremental backups every 4 hours. If the system fails at 2:30 PM, what is the maximum data loss in terms of time?

Accepted Answer

3.5 hours. The last backup was the incremental backup at 11 AM (assuming 4-hour intervals from 11 PM). The failure at 2:30 PM means data from 11 AM to 2:30 PM (3.5 hours) could be lost, which exceeds the 1-hour RPO.

Answer

1 hour

Answer

15.5 hours

Answer

1.5 hours

Question 5

After a ransomware attack, the IT team restores systems from backups. The CEO asks how quickly data can be recovered. Which metric addresses the acceptable amount of data loss?

Accepted Answer

Recovery Point Objective (RPO). RPO defines the maximum acceptable data loss measured in time.

Answer

Work Recovery Time (WRT)

Answer

Recovery Time Objective (RTO)

Answer

Maximum Tolerable Downtime (MTD)

Question 6

During an incident, the incident response team identifies that a malware infection is spreading. They isolate affected systems to prevent further damage. Which phase of the incident response process are they performing?

Accepted Answer

Containment. Containment aims to limit the scope of the incident.

Answer

Recovery

Answer

Eradication

Answer

Detection

Question 7

A company is developing a business continuity plan. Which document identifies critical business functions and their dependencies, including the maximum acceptable downtime?

Accepted Answer

Business Impact Analysis (BIA). A Business Impact Analysis (BIA) identifies critical business functions, dependencies, and quantifies the impact of disruptions, including maximum tolerable downtime (MTD).

Answer

Disaster Recovery Plan (DRP)

Answer

Business Continuity Plan (BCP)

Answer

Incident Response Plan (IRP)

Question 8

Which incident category involves an attempt to make a system or network resource unavailable to its intended users?

Accepted Answer

Denial of service. A denial of service (DoS) attack aims to disrupt service availability by overwhelming resources.

Answer

Malware

Answer

Data breach

Answer

Social engineering

Question 9

A security analyst is prioritizing incidents based on severity. Which TWO factors are most important for determining incident severity?

Accepted Answer

Sensitivity of the data potentially compromised. Severity is based on impact (e.g., data sensitivity, criticality) and scope (affected users/systems).

Answer

Type of operating system involved

Answer

Time of day the incident occurred

Answer

Color of the server room

Question 10

Which phase of the incident response process involves actions to stop the incident from causing further damage, such as isolating affected systems?

Accepted Answer

Containment. Containment is the phase where actions are taken to limit the scope and impact of the incident.

Answer

Eradication

Answer

Analysis

Answer

Detection

Question 11

A hospital's electronic health record (EHR) system must be available 24/7. The disaster recovery plan specifies an RTO of 4 hours and an RPO of 1 hour. Which combination of backup and site strategy best meets these objectives?

Accepted Answer

Hot site with continuous data replication. A warm site with hourly incremental backups can achieve RTO of days? Actually, warm site RTO is typically days, so more suitable is hot site. But given options, warm site plus differential may be plausible? Better: hot site with frequent backups. However, the correct answer should be hot site with continuous replication to meet RPO of 1 hour and RTO of 4 hours.

Answer

Cloud-based recovery with daily snapshots

Answer

Warm site with weekly full backups

Answer

Cold site with daily full backups

Question 12

Which of the following is a key component of the 3-2-1 backup rule?

Accepted Answer

Three copies, two different media types, one off-site. The 3-2-1 rule states: have 3 copies of data, on 2 different media types, with 1 copy off-site.

Answer

Two copies on different media, one off-site

Answer

One copy on two different media, two off-site

Answer

Three copies on different media, two off-site

Question 13

A company has a reciprocal agreement with another organization for disaster recovery. During a major outage, the company attempts to activate the agreement but finds that the partner's facility is also impacted by the same disaster. This scenario highlights a primary disadvantage of which recovery strategy?

Accepted Answer

Reciprocal agreement. Reciprocal agreements depend on the partner not being affected by the same disaster. If both are impacted, the agreement fails.

Answer

Cold site

Answer

Warm site

Answer

Hot site

Question 14

During a BIA, the maximum tolerable downtime for a critical application is determined to be 4 hours. The IT team estimates system recovery will take 2 hours, but additional manual work to reconcile data will take 1 hour. What is the Recovery Time Objective (RTO)?

Accepted Answer

2 hours. RTO is the time within which systems must be recovered to avoid unacceptable consequences. Here, the system must be back within 2 hours to meet the 4-hour MTD, but recovery includes both system restoration and work recovery. The RTO is typically the time to restore systems to a functional state, which is 2 hours.

Answer

1 hour

Answer

4 hours

Answer

3 hours

Question 15

A financial institution requires near-instantaneous recovery of its trading platform after a disaster. The recovery time objective (RTO) is 2 hours, and the recovery point objective (RPO) is 15 minutes. Which recovery site strategy best meets these requirements?

Accepted Answer

Hot site. A hot site mirrors the production environment continuously, allowing recovery within hours and minimal data loss.

Answer

Reciprocal agreement

Answer

Warm site

Answer

Cold site