ISC2 CC Business Continuity, DR & Incident Response — 30 Questions

Question 1

A SOC analyst receives an alert indicating a user executed a PowerShell script that initiated outbound connections to an external IP. The script was delivered via email attachment. Which incident response phase is MOST appropriate for containing this threat?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Eradication phase. When an alert is received, identification has already occurred. The next step is to contain the threat, which is typically part of the eradication phase in the ISC2 CC framework. Containment activities such as isolating the system and blocking connections are performed during the eradication phase. Therefore, option B (Eradication phase) is the most appropriate for containing the threat.

Answer

Identification phase

Answer

Recovery phase

Answer

Preparation phase

Question 2

An organization uses a primary data center and a backup site 500 miles away. The backup site replicates data synchronously. Which risk is MOST likely introduced by this configuration?

Accepted Answer

Increased latency for write operations. Synchronous replication requires the primary site to wait for an acknowledgment from the backup site before completing each write operation. The 500-mile distance introduces a minimum round-trip latency of approximately 8-10 ms (based on fiber optic propagation at ~200 km/ms), which directly increases the time taken for write operations. This latency impact is the most likely risk introduced by this configuration.

Answer

High recovery point objective (RPO)

Answer

Data encryption overhead

Answer

Insufficient bandwidth between sites

Question 3

Which THREE elements are essential components of a business continuity plan (BCP)?

Accepted Answer

Data backup schedules and procedures. A business continuity plan must be grounded in a business impact analysis (BIA), so option B is correct because the BIA identifies critical business functions, recovery time objectives (RTOs), and recovery point objectives (RPOs) that drive the entire continuity strategy. Option A is correct because data backup schedules and procedures are essential to restore systems and data within the RTO/RPO targets defined by the BIA, directly enabling recovery of operations. Option D is correct because emergency contact lists ensure the right personnel, vendors, and stakeholders can be reached immediately during a disruption to activate and coordinate the BCP. Option C is not essential to a BCP because an incident response team roster belongs to the incident response plan, which handles detection and containment of security events rather than long-term business continuity. Option E is not essential because detailed network topology diagrams are supporting technical documentation, not a core BCP element, and continuity planning focuses on business processes and recovery priorities rather than network design detail.

Answer

Incident response team roster

Answer

Detailed network topology diagrams

Question 4

Based on the backup schedule, what is the maximum potential data loss?

Accepted Answer

33 hours (data since Tuesday 01:00). Maximum potential data loss is determined by the interval between the last successful backup and the point of failure. In a differential backup scheme, each differential contains all changes since the last full backup. If the most recent differential backup fails or is unavailable, the last successful backup becomes the previous differential. Here, the backup schedule includes a full backup on Monday at 01:00 and differential backups every 12 hours starting Tuesday at 01:00 (i.e., Tuesday 01:00, Tuesday 13:00, Wednesday 01:00, etc.). To maximize potential data loss, we assume the most recent differential backup (Tuesday 13:00) is lost, so the last successful backup is the differential from Tuesday 01:00. If a failure occurs just before the next scheduled differential (Wednesday 10:00), the data loss spans from Tuesday 01:00 to Wednesday 10:00, which is 33 hours. This is the maximum possible data loss given the schedule. Answer C correctly identifies this.

Answer

9 hours (since Tuesday 01:00)

Answer

2 days (data since Monday)

Answer

1 day (data since last full backup)

Question 5

An organization experiences a ransomware attack that encrypts critical file servers. The backups are stored on a separate network segment but are also encrypted. The incident response team suspects the attacker compromised the backup system using stored credentials. Which best practice should have been implemented to prevent this?

Accepted Answer

Enable multi-factor authentication (MFA) on backup system access. Enabling multi-factor authentication (MFA) on backup system access would have prevented the attacker from using stored credentials to compromise the backup system. MFA requires an additional authentication factor beyond just a password or stored token, making credential theft or reuse insufficient for access. This directly addresses the attack vector described—stolen credentials—rather than relying solely on network segmentation or encryption.

Answer

Implement air-gapped backups stored offline

Answer

Encrypt backup data at rest and in transit

Answer

Use a separate VLAN for backup traffic

Question 6

A mid-sized e-commerce company has a primary data center in New York and a disaster recovery site in Dallas. The application stack includes a web server, application server, and a PostgreSQL database. The database uses synchronous replication to the DR site. During a routine failover test, the IT team discovers that after failing over to Dallas, the web servers in New York continue to attempt connections to the original database IP, causing application errors. The DNS records have been updated to point to the DR database IP, but the web servers are not refreshing their DNS cache. The company uses a standard TTL of 300 seconds. The IT manager needs a solution that ensures minimal disruption during future failovers. Which action should be taken?

Accepted Answer

Implement a load balancer or proxy with a virtual IP that can be switched during failover, and update the web server configuration to connect to the virtual IP. It decouples the web servers from the database IP address by introducing a load balancer or proxy with a virtual IP (VIP). During failover, the VIP is simply moved to the DR database, and the web servers continue connecting to the same VIP without any DNS dependency or cache refresh issues. This eliminates the problem of stale DNS caches and ensures minimal disruption, as the connection endpoint remains constant.

Answer

Add a static host entry in the web servers' hosts file pointing to the DR database IP

Answer

Increase the DNS TTL to 86400 seconds to ensure all caches are updated quickly

Answer

Configure the web servers to use a different DNS resolver that does not cache

Question 7

A company's primary data center experiences a complete power failure, and operations are shifted to a secondary site. The failover process takes 4 hours, but the recovery point objective (RPO) is set to 1 hour. Which of the following is the most likely consequence of this incident?

Accepted Answer

Data loss of up to 3 hours occurred.. The RPO of 1 hour means the company can tolerate losing up to 1 hour of data. Since the failover took 4 hours, any data written in the 3 hours before the power failure that had not yet been replicated to the secondary site would be lost. This results in a data loss window of up to 3 hours, exceeding the RPO.

Answer

The failover process was unsuccessful.

Answer

No data loss occurred because the secondary site was available.

Answer

The recovery time objective (RTO) was not met.

Question 8

Which TWO of the following are primary objectives of an incident response plan? (Choose two.)

Accepted Answer

Return affected systems to normal operation. Option B is correct because a core objective of an incident response plan is to restore affected systems to normal operation as quickly and safely as possible, which is the recovery phase of the incident response lifecycle (e.g., NIST SP 800-61). Option D is correct because minimizing the impact of an incident—limiting damage, reducing downtime, and containing the scope—is a primary goal that drives the entire response effort. Option A is not a primary objective of the incident response plan itself; business continuity is typically addressed by a separate BCP/DR plan, though IR supports it. Option C is not a primary objective—evidence collection is a supporting activity performed when needed, not a universal goal of every incident response. Option E is not a primary objective either; root cause analysis is part of post-incident activities and forensics, but the immediate objectives focus on containment, eradication, recovery, and impact reduction.

Answer

Ensure business continuity during the incident

Answer

Collect evidence for legal proceedings

Answer

Identify the root cause of the incident

Question 9

Refer to the exhibit. A security analyst observes that users from the 192.168.1.0/24 network cannot access HTTPS websites, but HTTP access works fine. What is the most likely cause?

Accepted Answer

The ACL is applied to the wrong interface or direction.. The exhibit shows an ACL that permits both HTTP (TCP 80) and HTTPS (TCP 443) inbound on the outside interface. However, the issue is that internal users cannot initiate outbound HTTPS connections. Since the ACL is applied inbound on the outside interface, it only controls incoming traffic, not outgoing. Therefore, the most likely cause is that the ACL is applied to the wrong interface or direction. The implicit deny at the end of the ACL would block any traffic not explicitly permitted, but because the ACL correctly permits HTTPS inbound, the failure of outbound HTTPS suggests a placement error. This is a common scenario where an ACL that should be applied outbound on the inside interface is mistakenly applied inbound on the outside interface, resulting in asymmetric filtering.

Answer

The implicit deny at the end of the ACL blocks HTTPS traffic.

Answer

The ACL is missing a permit statement for TCP port 443 return traffic.

Answer

The ACL explicitly denies TCP port 443.

Question 10

Match each access control model to its key characteristic.

Accepted Answer

DAC: Access decisions are based on the identity of the user and are at the discretion of the resource owner.. In the ISC2 CC exam, the three main access control models are DAC, MAC, and RBAC. DAC allows resource owners to control access, MAC uses labels and clearances, and RBAC uses roles.

Answer

DAC: Access decisions are based on security labels and clearance levels.

Answer

MAC: Access decisions are based on the roles assigned to users.

Question 11

Match each cryptographic concept to its definition.

Accepted Answer

Symmetric encryption: Uses a single shared key for both encryption and decryption.. Symmetric encryption uses one shared key; asymmetric uses a public-private key pair; hashing is a one-way function; digital signatures use asymmetric cryptography for authentication, integrity, and non-repudiation. Common confusions include mixing up symmetric and asymmetric key usage, or thinking hashing is reversible.

Answer

Symmetric encryption: Uses a pair of keys (public and private) for encryption and decryption.

Answer

Hashing: A reversible process that transforms data into a fixed-size representation.

Question 12

A company's backup strategy involves daily full backups only. What is the primary risk associated with this approach?

Accepted Answer

Recovery Time Objective (RTO) may be exceeded due to long restore. With daily full backups only, the Recovery Point Objective (RPO) is effectively 24 hours, which may be acceptable depending on business requirements. However, the primary risk is that restoring from a single full backup can take a very long time, especially for large datasets, potentially exceeding the Recovery Time Objective (RTO). This is because full backups contain all data and must be restored entirely, unlike incremental or differential backups that allow faster recovery by restoring only changed blocks.

Answer

Recovery Point Objective (RPO) may be too long

Answer

High cost of backup storage

Answer

Data corruption could spread across backups

Question 13

A primary data center is destroyed. The disaster recovery plan calls for activation of a hot standby site. If the RTO is 2 hours, what is the expected recovery time?

Accepted Answer

Less than 2 hours. The RTO (Recovery Time Objective) defines the maximum acceptable downtime, not the guaranteed recovery time. A hot standby site is fully operational and synchronized, so recovery can be completed in less than the RTO if the disaster does not cause additional complications. Option D is correct because the expected recovery time should be less than the 2-hour RTO, assuming the hot site functions as designed.

Answer

Exactly 2 hours

Answer

More than 2 hours

Answer

Unknown, depends on the disaster

Question 14

Which TWO are primary objectives of a Business Continuity Plan (BCP)? (Select two.)

Accepted Answer

Ensure employee safety. Option B (Ensure employee safety) is correct because the protection of human life is universally recognized as the first and foremost objective of any Business Continuity Plan; no recovery activity should proceed until personnel are accounted for and safe. Option D (Minimize financial loss) is correct because a core purpose of a BCP is to reduce the economic impact of a disruption by maintaining or quickly resuming critical business functions, thereby limiting lost revenue, penalties, and recovery costs. Option A (Comply with regulations) is a driver or benefit of having a BCP rather than a primary objective of the plan itself, and option C (Restore IT systems within RTO) is a Disaster Recovery Plan objective focused on technology recovery, not the broader business-focused BCP. Option E (Protect brand reputation) is a desirable outcome of effective continuity management but is a secondary consequence rather than a primary objective of the BCP.

Answer

Comply with regulations

Answer

Restore IT systems within RTO

Answer

Protect brand reputation

Question 15

Refer to the exhibit. Based on the backup log, what is the most likely corrective action?

Accepted Answer

Add more storage space to the backup target. The backup log in the exhibit (not shown here, but implied by the answer) indicates the backup job failed because the target ran out of space — a classic 'insufficient disk space' or 'media full' error. The corrective action is to add more storage capacity to the backup target so the job can complete. Rescheduling, checking network connectivity, or replacing the tape drive would not resolve a capacity exhaustion error.

Answer

Reschedule the backup for a later time

Answer

Check network connectivity

Answer

Replace the tape drive

Question 16

Refer to the exhibit. Based on the report, which improvement is most appropriate?

Accepted Answer

Switch to synchronous replication. The exhibit report shows a replication lag or data-loss indicator that violates the business continuity requirement, and synchronous replication is the appropriate fix because it guarantees zero data loss by acknowledging writes only after the standby confirms them. This addresses the root cause shown in the report rather than a symptom.

Answer

Increase backup frequency

Answer

Reduce network failover time

Answer

Implement load balancing

Question 17

An organization uses a warm site for disaster recovery. Which of the following is the MOST significant risk of this approach?

Accepted Answer

Data may not be synchronized with the primary site. A warm site has infrastructure and connectivity ready but does not maintain real-time data synchronization with the primary site. The most significant risk is that data may not be synchronized, meaning the Recovery Point Objective (RPO) could be hours or days old, leading to potential data loss during failover. Unlike a hot site with synchronous replication, a warm site typically uses periodic backups or asynchronous replication, creating a gap in data currency.

Answer

The site may be too far away

Answer

The site may not have recent data

Answer

High cost of maintaining duplicate hardware

Question 18

During a disaster recovery test, the team discovers that the backup generator fails to start. What is the BEST immediate action?

Accepted Answer

Document the issue and proceed. The immediate priority during a disaster recovery test is to document the failure and continue the test to evaluate the remaining components of the DR plan. The backup generator failure is a specific issue that should be logged for post-test remediation, but aborting the test prematurely would lose valuable data on other failover mechanisms, such as UPS runtime, network redundancy, or application recovery. Proceeding with documentation ensures the test's integrity while capturing the incident for root cause analysis.

Answer

Continue the test with manual procedures

Answer

Cancel the test

Answer

Shut down the data center

Question 19

Which TWO are phases of the NIST incident response life cycle? (Select exactly 2.)

Accepted Answer

Preparation. Option A (Preparation) is correct because the NIST SP 800-61 incident response life cycle begins with the Preparation phase, which covers establishing an IR capability, acquiring tools, and developing policies before an incident occurs. Option E (Containment) is correct because Containment is a distinct phase within the NIST life cycle (grouped under Detection and Analysis followed by Containment, Eradication, and Recovery) focused on limiting the scope and impact of an incident. The other options do not belong: Documentation is an ongoing activity rather than a named phase, Assessment is not a phase in the NIST model (it resembles activities in Detection and Analysis), and Authorization is a security control/management process (e.g., access authorization) rather than an incident response life cycle phase.

Answer

Documentation

Answer

Assessment

Answer

Authorization

Question 20

Which THREE are commonly defined in a disaster recovery plan? (Select exactly 3.)

Accepted Answer

Recovery point objective. A disaster recovery plan commonly defines the Recovery point objective (RPO), which specifies the maximum tolerable amount of data loss measured in time, and the Recovery time objective (RTO), which specifies the maximum tolerable downtime before systems must be restored; both are core DR metrics that drive backup frequency and restoration strategies. A Business impact analysis (BIA) is also commonly defined in a DR plan because it identifies critical business functions, dependencies, and the impact of their disruption, which in turn establishes the RPO and RTO targets. Cost-benefit analysis (D) is a general financial justification technique used when selecting controls, not a standard component defined within a DR plan, and Annual loss expectancy (E) is a quantitative risk-analysis value (SLE × ARO) used in risk assessment rather than a DR plan element.

Answer

Cost-benefit analysis

Answer

Annual loss expectancy