ISC2 CC Business Continuity, DR & Incident Response Practice Test 3 — 15 Questions

Question 1

A small manufacturing company's IT infrastructure consists of a single server running ERP and file services, with a nightly backup to an external hard drive. The server fails due to hardware failure. The company's BCP states that the ERP system must be restored within 8 hours. The backup is 12 hours old. The IT administrator has a spare server of similar configuration. What is the BEST course of action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Install the backup onto the spare server and restore the data from the external hard drive.. The spare server has a similar configuration, allowing the IT administrator to install the backup software and restore the ERP system and file data from the external hard drive. This approach meets the 8-hour RTO by leveraging the existing backup, even though it is 12 hours old, as the restore process is straightforward and does not require ordering new hardware or migrating to a cloud platform.

Answer

Use cloud-based ERP temporarily.

Answer

Perform a bare-metal restore using the backup.

Answer

Order a new server from the vendor (lead time 3 days).

Question 2

An online retailer has a DR plan that includes active-active data centers. During a major DDoS attack, one data center's external connectivity is saturated. The internal network is operational. The security team has identified the attack traffic pattern and is working with the ISP to filter. To maintain service availability, what action should be taken?

Accepted Answer

Redirect all traffic to a cloud-based scrubbing center.. A cloud-based scrubbing center (DDoS mitigation service) can filter malicious traffic before it reaches the retailer's network, preserving the active-active data center architecture. Since the internal network is operational, the attack only saturates external connectivity; redirecting traffic to the scrubbing center allows clean traffic to be re-injected into the data centers, maintaining service availability without taking any site offline.

Answer

Shut down the attacked data center and fail all traffic to the other data center.

Answer

Implement rate limiting on the affected network segment.

Answer

Continue monitoring and let the ISP handle the attack.

Question 3

You are the cybersecurity lead for a mid-sized retail company. One morning, employees report that they cannot access files on the shared drive, and a ransom note appears on several screens demanding $50,000 in Bitcoin. The company has a formal incident response plan that was last updated two years ago and has never been tested. Backups are taken nightly to an on-premises tape library and also replicated to a cloud storage service but have not been verified recently. The CEO is insisting on paying the ransom to avoid business disruption. Which of the following is the MOST appropriate first course of action?

Accepted Answer

Isolate the infected systems from the network, then restore data from the most recent verified backup.. The first priority in any ransomware incident is containment: isolating infected systems prevents lateral movement and further encryption. Restoring from the most recent verified backup ensures data integrity and avoids paying the ransom, which does not guarantee decryption and funds criminal activity. The incident response plan should then be activated and updated based on lessons learned.

Answer

Delete all infected files and rebuild the file server from scratch without involving backups.

Answer

Ignore the incident and continue operations, assuming it will resolve on its own.

Answer

Pay the ransom immediately to minimize downtime and recover data quickly.

Question 4

During a ransomware incident, the incident response team isolates affected systems. Which of the following is the NEXT best step?

Accepted Answer

Preserve forensic evidence from the isolated systems.. After isolating affected systems during a ransomware incident, the next best step is to preserve forensic evidence from those systems. This ensures that data such as memory dumps, logs, and encrypted files are captured intact for analysis, which is critical for understanding the attack vector, identifying the ransomware variant, and potentially recovering data without paying the ransom. Forensic preservation must occur before any remediation steps like wiping or rebuilding, as those actions would destroy the evidence needed for investigation and legal proceedings.

Answer

Wipe and rebuild all affected systems.

Answer

Notify law enforcement immediately.

Answer

Pay the ransom to restore operations quickly.

Question 5

An organization's recovery time objective (RTO) for its customer database is 4 hours. During a disaster, the backup restore process takes 2 hours, but reconfigure and test tasks add another 3 hours. Which action best addresses this gap?

Accepted Answer

Automate the configuration and validation steps after restore.. The RTO is 4 hours, but the actual recovery time is 2 hours (restore) + 3 hours (reconfigure and test) = 5 hours, exceeding the RTO by 1 hour. Automating the configuration and validation steps (option D) reduces the post-restore manual effort, bringing the total recovery time closer to or within the 4-hour RTO. This directly addresses the gap without altering the RTO or neglecting testing.

Answer

Conduct the restore test only during annual disaster recovery drills.

Answer

Reduce the recovery point objective (RPO) to minimize data loss.

Answer

Increase the RTO to 6 hours.

Question 6

A company's business continuity plan includes an alternate work site with full IT capabilities. Which type of recovery site does this describe?

Accepted Answer

Hot site. A hot site is a fully equipped alternate work site with all necessary IT infrastructure—servers, networking, telecommunications, and power—ready to take over operations immediately. The question specifies 'full IT capabilities,' which aligns with the hot site's purpose of enabling rapid failover with minimal downtime, typically within hours.

Answer

Mobile site

Answer

Cold site

Answer

Warm site

Question 7

Which TWO actions are appropriate during the identification phase of incident response?

Accepted Answer

Correlate alerts from multiple sources.. During the identification phase, responders must determine whether an incident has actually occurred and scope it, so option B (correlate alerts from multiple sources) is correct because aggregating and cross-referencing alerts from SIEM, IDS/IPS, EDR, and other telemetry helps confirm a true positive and establish the incident's extent. Option C (review system logs for anomalies) is also correct because examining OS, application, and security logs for unusual events, timestamps, and indicators of compromise is a core identification activity that validates and characterizes the suspected incident. Option A (post-mortem analysis) belongs to the lessons-learned/ post-incident phase after containment, eradication, and recovery. Option D (restore data from backups) is a recovery-phase action, and option E (disconnect affected systems from the network) is a containment action, both of which occur after the incident has been identified.

Answer

Conduct a post-mortem analysis.

Answer

Restore data from backups.

Answer

Disconnect affected systems from the network.

Question 8

Based on the incident log, at which step did the incident response team contain the threat?

Accepted Answer

14:25 - Isolated WKS-045 from network. Containment is the immediate step to prevent the threat from spreading, and isolating WKS-045 from the network at 14:25 achieves this by cutting off its network connectivity. This aligns with the NIST SP 800-61 incident response lifecycle, where containment is prioritized before eradication or recovery. The log shows isolation occurred before scanning or removal, making it the correct containment action.

Answer

14:30 - Scanned system, detected Trojan.Downloader

Answer

14:45 - Removed malware via AV

Answer

14:35 - Escalated to incident handler

Question 9

You are the incident response lead for a financial services company. At 09:00, the SOC detects unusual outbound traffic from a server in the DMZ to an external IP known to be a command-and-control (C2) server. The server runs a legacy application that cannot be patched. The server is critical for customer transactions, but an alternate manual process can sustain operations for up to 4 hours. The CTO wants to keep the server online to avoid customer impact. The CEO is concerned about data exfiltration. The compliance officer reminds you of regulatory requirements to report breaches within 72 hours. Which action should you take FIRST?

Accepted Answer

Disconnect the server from the network and activate the manual process.. The correct first action is to disconnect the server from the network and activate the manual process. This immediately stops potential data exfiltration to the C2 server and contains the incident, aligning with the NIST incident response lifecycle's containment phase. Since the server runs a legacy application that cannot be patched and the manual process can sustain operations for up to 4 hours, isolation is both feasible and necessary to prevent further compromise while maintaining business continuity.

Answer

Report the incident to the regulatory authority immediately.

Answer

Perform a forensic analysis of the server to determine the scope of compromise.

Answer

Keep the server online under close monitoring to minimize customer disruption.

Question 10

During a tabletop exercise for a data center outage, the IT manager realizes that the disaster recovery plan does not specify how to failover the database cluster. The primary data center fails completely. The standby site has a replica of the database, but the application team cannot promote it because they lack the necessary privileges. What is the most likely cause of this gap?

Accepted Answer

The DR plan did not include role-based access for failover operations. The scenario explicitly states that the application team lacks the necessary privileges to promote the standby database. This indicates that the disaster recovery plan did not define role-based access controls (RBAC) or assign failover permissions to specific personnel or groups. Without documented roles and privileges, even a fully replicated standby database cannot be promoted, causing a failover gap.

Answer

The standby site's network connectivity was not tested

Answer

The database replication configuration was incorrect

Answer

The database failover procedure was not documented

Question 11

Which TWO actions are most effective in reducing the mean time to detect (MTTD) a security incident?

Accepted Answer

Implementing a SIEM with centralized logging from critical systems. A SIEM with centralized logging aggregates and correlates logs from critical systems, enabling real-time analysis and automated alerting. This drastically reduces MTTD by surfacing indicators of compromise (IoCs) within minutes rather than hours or days, as manual log review would require.

Answer

Requiring multi-factor authentication for all remote access

Answer

Conducting annual security awareness training for all employees

Answer

Standardizing firewall rules across all network segments

Question 12

The exhibit shows a syslog-ng client configuration and a firewall rule on the central logging server (IP 10.0.0.10). The client (192.168.1.100) is not sending logs to the server. What is the most likely cause?

Accepted Answer

The firewall rule restricts source port 6514, but the client uses a random ephemeral source port. The firewall rule on the central logging server (10.0.0.10) specifies a source port of 6514. However, syslog-ng clients, when sending over TCP or TLS, typically use a random ephemeral source port (e.g., above 1024) rather than a fixed source port. Since the firewall restricts the source port to exactly 6514, the client's packets are dropped, preventing logs from reaching the server.

Answer

The syslog-ng configuration uses TLS, but the firewall rule does not allow TLS traffic

Answer

The syslog-ng client uses UDP by default, but the firewall allows only TCP

Answer

The firewall rule does not include the client IP 192.168.1.100

Question 13

Drag and drop the steps for the TCP three-way handshake into the correct order.

Accepted Answer

SYN, then SYN-ACK, then ACK. The TCP three-way handshake is a three-step process used to establish a reliable connection. The client initiates by sending a SYN (synchronize) packet to the server. The server responds with a SYN-ACK (synchronize-acknowledge) packet, acknowledging the client's request and indicating its own synchronization. Finally, the client sends an ACK (acknowledge) packet to confirm the connection establishment. This sequence ensures both sides agree on initial sequence numbers and that the connection is ready for data transfer.

Answer

SYN, then ACK, then SYN-ACK

Answer

SYN-ACK, then SYN, then ACK

Answer

ACK, then SYN, then SYN-ACK

Question 14

Drag and drop the steps for the proper disposal of a hard drive containing sensitive data into the correct order.

Accepted Answer

Identification, Backup, Sanitization, Verification, Documentation. Proper disposal includes identification, backup, sanitization, verification, and documentation.

Answer

Sanitization, Backup, Identification, Verification, Documentation

Answer

Identification, Sanitization, Verification, Backup, Documentation

Answer

Documentation, Identification, Backup, Sanitization, Verification

Question 15

An organization discovers a ransomware infection on a critical server. According to the incident response phases, what should be the first action after detection?

Accepted Answer

Contain the affected system. Immediately after detection, the priority is to contain the ransomware to prevent it from spreading laterally to other systems. According to NIST SP 800-61 and standard incident response frameworks, containment is the first step after detection and analysis, as it limits damage and preserves evidence for forensic investigation.

Answer

Notify law enforcement

Answer

Eradicate the malware from the server

Answer

Restore from backup