ISC2 CC Business Continuity, DR & Incident Response Practice Test 2 — 15 Questions

Question 1

A company's primary data center experiences a complete power failure, and operations are shifted to a secondary site. The failover process takes 4 hours, but the recovery point objective (RPO) is set to 1 hour. Which of the following is the most likely consequence of this incident?

Accepted Answer

Data loss of up to 3 hours occurred.. The RPO of 1 hour means the company can tolerate losing up to 1 hour of data. Since the failover took 4 hours, any data written in the 3 hours before the power failure that had not yet been replicated to the secondary site would be lost. This results in a data loss window of up to 3 hours, exceeding the RPO.

Answer

The failover process was unsuccessful.

Answer

No data loss occurred because the secondary site was available.

Answer

The recovery time objective (RTO) was not met.

Question 2

Which TWO of the following are primary objectives of an incident response plan? (Choose two.)

Accepted Answer

Return affected systems to normal operation. Option B is correct because a primary objective of an incident response plan is to return affected systems to normal operation. This involves containment, eradication, and recovery steps to restore business functions after a security incident, ensuring the organization can resume operations securely.

Answer

Ensure business continuity during the incident

Answer

Collect evidence for legal proceedings

Answer

Identify the root cause of the incident

Question 3

Refer to the exhibit. A security analyst observes that users from the 192.168.1.0/24 network cannot access HTTPS websites, but HTTP access works fine. What is the most likely cause?

Accepted Answer

The ACL is applied to the wrong interface or direction.. The exhibit shows an ACL that permits HTTP (TCP 80) but does not explicitly permit HTTPS (TCP 443). However, the question states that HTTP works and HTTPS does not, which suggests the ACL is correctly filtering inbound traffic on the outside interface. The most likely cause is that the ACL is applied to the wrong interface or direction, because if it were applied inbound on the inside interface, it would block outbound HTTPS traffic from the 192.168.1.0/24 network. The implicit deny at the end of the ACL would block any traffic not explicitly permitted, but since HTTP works, the issue is not the implicit deny itself but rather the placement of the ACL.

Answer

The implicit deny at the end of the ACL blocks HTTPS traffic.

Answer

The ACL is missing a permit statement for TCP port 443 return traffic.

Answer

The ACL explicitly denies TCP port 443.

Question 4

Drag and drop the steps for the TCP three-way handshake into the correct order.

Question 5

Drag and drop the steps for the proper disposal of a hard drive containing sensitive data into the correct order.

Question 6

Match each access control model to its key characteristic.

Question 7

Match each cryptographic concept to its definition.

Question 8

A company's backup strategy involves daily full backups only. What is the primary risk associated with this approach?

Accepted Answer

Recovery Time Objective (RTO) may be exceeded due to long restore. With daily full backups only, the Recovery Point Objective (RPO) is effectively 24 hours, which may be acceptable depending on business requirements. However, the primary risk is that restoring from a single full backup can take a very long time, especially for large datasets, potentially exceeding the Recovery Time Objective (RTO). This is because full backups contain all data and must be restored entirely, unlike incremental or differential backups that allow faster recovery by restoring only changed blocks.

Answer

Recovery Point Objective (RPO) may be too long

Answer

High cost of backup storage

Answer

Data corruption could spread across backups

Question 9

An organization discovers a ransomware infection on a critical server. According to the incident response phases, what should be the first action after detection?

Accepted Answer

Contain the affected system. Immediately after detection, the priority is to contain the ransomware to prevent it from spreading laterally to other systems. According to NIST SP 800-61 and standard incident response frameworks, containment is the first step after detection and analysis, as it limits damage and preserves evidence for forensic investigation.

Answer

Notify law enforcement

Answer

Eradicate the malware from the server

Answer

Restore from backup

Question 10

Which metric defines the maximum acceptable amount of data loss measured in time?

Accepted Answer

Recovery Point Objective (RPO). The Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss measured in time, typically expressed in seconds, minutes, or hours. It represents the age of the most recent backup or replicated data that must be available to resume operations after a disaster, directly determining the frequency of backups or replication intervals.

Answer

Mean Time Between Failures (MTBF)

Answer

Mean Time to Repair (MTTR)

Answer

Recovery Time Objective (RTO)

Question 11

A primary data center is destroyed. The disaster recovery plan calls for activation of a hot standby site. If the RTO is 2 hours, what is the expected recovery time?

Accepted Answer

Less than 2 hours. The RTO (Recovery Time Objective) defines the maximum acceptable downtime, not the guaranteed recovery time. A hot standby site is fully operational and synchronized, so recovery can be completed in less than the RTO if the disaster does not cause additional complications. Option D is correct because the expected recovery time should be less than the 2-hour RTO, assuming the hot site functions as designed.

Answer

Exactly 2 hours

Answer

More than 2 hours

Answer

Unknown, depends on the disaster

Question 12

During a disaster recovery test, backup tapes fail to restore data due to format incompatibility. Which element of the Business Continuity Plan should be updated?

Accepted Answer

Plan testing and maintenance. The failure of backup tapes to restore data due to format incompatibility indicates that the recovery procedures and tools were not validated during testing. This directly points to a deficiency in the 'Plan testing and maintenance' element, which ensures that backup media formats, restoration tools, and procedures are regularly verified and updated to match the current production environment. Without scheduled testing and maintenance, format drift between backup software versions or hardware changes can render tapes unreadable.

Answer

Business Impact Analysis (BIA)

Answer

Recovery strategies

Answer

Communication plan

Question 13

Which is a key benefit of a cold site as a recovery location?

Accepted Answer

Low cost. A cold site is a backup facility that provides only the physical infrastructure (power, cooling, and space) but no pre-installed hardware or live data. Because it lacks equipment and requires manual setup before recovery can begin, it has the lowest capital and operational costs among recovery site options, making low cost its key benefit.

Answer

Real-time data synchronization

Answer

Reduced need for testing

Answer

Fast recovery time

Question 14

During a disaster recovery exercise, the system fails to achieve the RTO. Analysis shows that restoring the database from tape takes 3 hours, but the RTO is 2 hours. Which is the most effective solution?

Accepted Answer

Implement a hot standby database replica. The correct answer is C because the RTO (Recovery Time Objective) is a business requirement that cannot be changed by simply adjusting the backup method. A hot standby database replica (e.g., using synchronous replication or Oracle Data Guard) provides near-instant failover, reducing recovery time to minutes, which directly meets the 2-hour RTO. This solution addresses the root cause—the restore process is too slow—by eliminating the need to restore from backup entirely.

Answer

Use differential instead of full backups

Answer

Switch from tape to disk-based backups

Answer

Increase the RTO to 3 hours

Question 15

According to the NIST 800-61 incident response lifecycle, after containment and eradication have been performed, what is the next phase?

Accepted Answer

Recovery. According to the NIST 800-61 incident response lifecycle, the phases are Preparation, Detection & Analysis, Containment/Eradication, and Recovery. After containment (isolating the threat) and eradication (removing malware, patching vulnerabilities), the next phase is Recovery, where systems are carefully restored to normal operations, often using clean backups and verifying system integrity before reconnecting to the network.

Answer

Post-incident activity

Answer

Detection and analysis

Answer

Preparation