ISC2 CC Business Continuity, DR & Incident Response Practice Test 2 — 15 Questions

Question 1

Refer to the exhibit. Based on the report, which improvement is most appropriate?

Accepted Answer

Switch to synchronous replication. The exhibit report shows a replication lag or data-loss indicator that violates the business continuity requirement, and synchronous replication is the appropriate fix because it guarantees zero data loss by acknowledging writes only after the standby confirms them. This addresses the root cause shown in the report rather than a symptom.

Answer

Increase backup frequency

Answer

Reduce network failover time

Answer

Implement load balancing

Question 2

An organization uses a warm site for disaster recovery. Which of the following is the MOST significant risk of this approach?

Accepted Answer

Data may not be synchronized with the primary site. A warm site has infrastructure and connectivity ready but does not maintain real-time data synchronization with the primary site. The most significant risk is that data may not be synchronized, meaning the Recovery Point Objective (RPO) could be hours or days old, leading to potential data loss during failover. Unlike a hot site with synchronous replication, a warm site typically uses periodic backups or asynchronous replication, creating a gap in data currency.

Answer

The site may be too far away

Answer

The site may not have recent data

Answer

High cost of maintaining duplicate hardware

Question 3

During a disaster recovery test, the team discovers that the backup generator fails to start. What is the BEST immediate action?

Accepted Answer

Document the issue and proceed. The immediate priority during a disaster recovery test is to document the failure and continue the test to evaluate the remaining components of the DR plan. The backup generator failure is a specific issue that should be logged for post-test remediation, but aborting the test prematurely would lose valuable data on other failover mechanisms, such as UPS runtime, network redundancy, or application recovery. Proceeding with documentation ensures the test's integrity while capturing the incident for root cause analysis.

Answer

Continue the test with manual procedures

Answer

Cancel the test

Answer

Shut down the data center

Question 4

Which TWO are phases of the NIST incident response life cycle? (Select exactly 2.)

Accepted Answer

Preparation. Option A (Preparation) is correct because the NIST SP 800-61 incident response life cycle begins with the Preparation phase, which covers establishing an IR capability, acquiring tools, and developing policies before an incident occurs. Option E (Containment) is correct because Containment is a distinct phase within the NIST life cycle (grouped under Detection and Analysis followed by Containment, Eradication, and Recovery) focused on limiting the scope and impact of an incident. The other options do not belong: Documentation is an ongoing activity rather than a named phase, Assessment is not a phase in the NIST model (it resembles activities in Detection and Analysis), and Authorization is a security control/management process (e.g., access authorization) rather than an incident response life cycle phase.

Answer

Documentation

Answer

Assessment

Answer

Authorization

Question 5

Which THREE are commonly defined in a disaster recovery plan? (Select exactly 3.)

Accepted Answer

Recovery point objective. A disaster recovery plan commonly defines the Recovery point objective (RPO), which specifies the maximum tolerable amount of data loss measured in time, and the Recovery time objective (RTO), which specifies the maximum tolerable downtime before systems must be restored; both are core DR metrics that drive backup frequency and restoration strategies. A Business impact analysis (BIA) is also commonly defined in a DR plan because it identifies critical business functions, dependencies, and the impact of their disruption, which in turn establishes the RPO and RTO targets. Cost-benefit analysis (D) is a general financial justification technique used when selecting controls, not a standard component defined within a DR plan, and Annual loss expectancy (E) is a quantitative risk-analysis value (SLE × ARO) used in risk assessment rather than a DR plan element.

Answer

Cost-benefit analysis

Answer

Annual loss expectancy

Question 6

In a cloud environment, the security team discovers that a misconfigured cloud storage bucket has made customer data publicly accessible. After securing the bucket, what is the most important next step?

Accepted Answer

Notify affected customers. After securing a misconfigured cloud storage bucket that exposed customer data, the most important next step is to notify affected customers. This aligns with incident response best practices and regulatory requirements (e.g., GDPR, HIPAA) that mandate timely disclosure of data breaches to impacted individuals. Without notification, the organization may face legal penalties and loss of trust, even if the data is now secure.

Answer

Delete the data

Answer

Review logs to determine access

Answer

Change the storage bucket policy

Question 7

An organization's backup strategy includes daily full backups. However, recovery tests show that restoring from tape takes 6 hours longer than expected. What is the most likely cause?

Accepted Answer

Improperly documented recovery procedures. The most likely cause for tape restore taking 6 hours longer than expected is improperly documented recovery procedures. If the procedures are unclear or incomplete, the recovery team may spend extra time figuring out steps, leading to delays. Tape drives are generally reliable, and while they can fail, the scenario implies the restore eventually succeeded, just slowly.

Answer

Tape drive failure

Answer

Inadequate storage capacity

Answer

Insufficient bandwidth

Question 8

Which THREE are primary phases of the incident response lifecycle?

Accepted Answer

Containment. The incident response lifecycle, as defined in NIST SP 800-61, consists of four primary phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. Option C (Preparation) is correct because it is the foundational phase where organizations establish incident response capabilities, including policies, tools, training, and communication plans before an incident occurs. Option E (Detection) is correct because it is the phase in which security events are identified, validated, and analyzed to confirm whether an incident has occurred. Option A (Containment) is correct because it is the phase where the scope and impact of the incident are limited to prevent further damage, typically followed by eradication and recovery. Option B (Forensic Analysis) is not a primary lifecycle phase; forensic analysis is a technique or activity that may be performed during detection/analysis or post-incident investigation, not a standalone phase. Option D (Data Archiving) is not a lifecycle phase; archiving is a data retention or backup activity that supports compliance and recovery but is not part of the core incident response lifecycle.

Answer

Forensic Analysis

Answer

Data Archiving

Question 9

Refer to the exhibit. What does this indicate?

Accepted Answer

The source file changed during backup. The exhibit shows a backup verification failure where the checksum or hash of the source file does not match the backup copy. This typically occurs when the source file is modified during the backup process (e.g., an open file that is being written to), causing the verification algorithm to detect a mismatch. The correct answer is A because the backup software correctly identifies that the source changed, not that the backup medium or file is corrupt.

Answer

The backup medium has errors

Answer

The verification algorithm is incorrect

Answer

The backup file is corrupt

Question 10

Refer to the exhibit. What is the effect of this ACL?

Accepted Answer

HTTPS traffic from 10.0.1.0/24 to 192.168.2.100 is permitted; all other HTTPS is denied. The ACL explicitly permits HTTPS (TCP port 443) traffic from source network 10.0.1.0/24 to destination host 192.168.2.100. Since ACLs have an implicit deny all at the end, any HTTPS traffic not matching this permit statement is denied. Option C correctly states that only this specific traffic is permitted and all other HTTPS is denied.

Answer

All HTTPS traffic is permitted

Answer

Only hosts from 10.0.1.0/24 can access HTTPS on 192.168.2.100

Answer

The ACL is invalid due to ordering

Question 11

A company's primary data center is located in a region prone to hurricanes. The IT team is designing a disaster recovery plan to ensure critical applications resume within 4 hours of a declared disaster. Which of the following is the MOST appropriate recovery strategy?

Accepted Answer

Hot site with synchronous replication (RTO 1 hour, RPO near zero). A hot site with synchronous replication is the most appropriate strategy because it provides an RTO of 1 hour (well within the 4-hour requirement) and an RPO near zero, ensuring critical applications resume quickly with minimal data loss. Synchronous replication writes data to both primary and replica storage simultaneously, so in a hurricane scenario, the hot site is fully operational and ready to take over immediately.

Answer

Colocation with tape backups shipped offsite (RTO 24 hours, RPO 24 hours)

Answer

Cold site with weekly full backups (RTO 48 hours, RPO 7 days)

Answer

Warm site with daily incremental backups (RTO 6 hours, RPO 4 hours)

Question 12

During an incident, the incident response team discovers that an attacker has exfiltrated sensitive customer data. According to incident response best practices, whose approval is REQUIRED before contacting law enforcement?

Accepted Answer

Legal counsel. Legal counsel approval is required before contacting law enforcement because they ensure that the disclosure complies with data privacy laws (e.g., GDPR, CCPA) and does not violate chain-of-custody requirements or expose the organization to liability. The incident response team must coordinate with legal to determine the appropriate timing and scope of law enforcement involvement, as premature contact can compromise ongoing forensic investigations or breach legal agreements.

Answer

CISO

Answer

CEO

Answer

Public relations

Question 13

A company is developing a disaster recovery plan for its database server. The database is updated transactionally and cannot tolerate any data loss. Which backup strategy meets this requirement?

Accepted Answer

Continuous database mirroring. Continuous database mirroring (C) is correct because it maintains a synchronous copy of the database on a secondary server, ensuring that every committed transaction is immediately written to both servers. This provides zero data loss (RPO=0) and automatic failover, which is required for a transactional database that cannot tolerate any data loss.

Answer

Log shipping with 15-minute intervals

Answer

Full backups nightly

Answer

Differential backups every 6 hours

Question 14

A small business with limited budget wants to ensure critical business functions can resume within 24 hours of a disaster. Their data changes infrequently. Which recovery solution is MOST cost-effective?

Accepted Answer

Cloud backup with instant restore. Cloud backup with instant restore (Option B) is the most cost-effective solution because the business has a limited budget, data changes infrequently, and the RTO is 24 hours. Cloud backup eliminates the need for maintaining physical infrastructure, and instant restore from cloud snapshots can meet the 24-hour RTO without the high costs of a warm or hot site.

Answer

Warm site with daily backups

Answer

Cold site with monthly backups

Answer

Hot site with real-time replication

Question 15

Your organization runs a critical e-commerce platform on a private cloud. The database server is located in a data center in a seismic zone. The current DR plan uses a warm site with daily differential backups and a 12-hour RTO. A recent earthquake caused a power outage but no physical damage. The database corruption was discovered after 6 hours. The backups from last night are intact but restoring involves applying transaction logs. The RTO is now at risk. What should be done FIRST?

Accepted Answer

Initiate the warm site recovery by restoring the latest differential backup onto standby servers.. The immediate priority is to restore the latest differential backup onto the warm site's standby servers. This approach minimizes recovery time by applying only the changes since the last full backup, directly addressing the RTO risk. The warm site is already prepared, and restoring the differential backup is the fastest path to operational readiness without the overhead of full backup restoration or log replay.

Answer

Fail over to the warm site immediately without data restoration.

Answer

Perform a point-in-time recovery using the last full backup and all transaction logs.

Answer

Restore the last full backup and then apply all subsequent differential and log backups.