ISC2 CC Business Continuity, DR & Incident Response Practice Test 3 — 15 Questions

Question 1

During a disaster recovery exercise, the system fails to achieve the RTO. Analysis shows that restoring the database from tape takes 3 hours, but the RTO is 2 hours. Which is the most effective solution?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement a hot standby database replica. The RTO (Recovery Time Objective) is a business requirement that cannot be changed by simply adjusting the backup method. A hot standby database replica (e.g., using synchronous replication or Oracle Data Guard) provides near-instant failover, reducing recovery time to minutes, which directly meets the 2-hour RTO. This solution addresses the root cause—the restore process is too slow—by eliminating the need to restore from backup entirely.

Answer

Use differential instead of full backups

Answer

Switch from tape to disk-based backups

Answer

Increase the RTO to 3 hours

Question 2

According to the NIST 800-61 incident response lifecycle, after containment and eradication have been performed, what is the next phase?

Accepted Answer

Recovery. According to the NIST 800-61 incident response lifecycle, the phases are Preparation, Detection & Analysis, Containment/Eradication, and Recovery. After containment (isolating the threat) and eradication (removing malware, patching vulnerabilities), the next phase is Recovery, where systems are carefully restored to normal operations, often using clean backups and verifying system integrity before reconnecting to the network.

Answer

Post-incident activity

Answer

Detection and analysis

Answer

Preparation

Question 3

Which statement best describes a warm site in disaster recovery?

Accepted Answer

It has hardware and network equipment but requires data restoration from backups. A warm site is a middle-ground disaster recovery option that has hardware and network infrastructure pre-installed but does not have live, synchronized data. Instead, data must be restored from backups (e.g., tape or disk snapshots) before operations can resume. This contrasts with a hot site, which maintains real-time data replication and fully active systems.

Answer

It has replicated data but no active systems

Answer

It is fully operational with real-time data synchronization

Answer

It has no hardware or infrastructure installed

Question 4

Which TWO are primary objectives of a Business Continuity Plan (BCP)? (Select two.)

Accepted Answer

Ensure employee safety. BCP focuses on ensuring employee safety and minimizing financial loss. Restoring IT systems is part of disaster recovery, not the primary BCP goal.

Answer

Comply with regulations

Answer

Restore IT systems within RTO

Answer

Protect brand reputation

Question 5

Which TWO are true about a differential backup? (Select two.)

Accepted Answer

It requires a full backup to be restored first. A differential backup copies all files that have changed since the last full backup. Because it does not contain the complete data set, you must first restore the most recent full backup and then apply the differential backup on top of it to recover the system. This makes option B correct.

Answer

It copies files changed since the last backup of any type

Answer

It resets the archive bit on backed-up files

Answer

It is faster to restore than a full backup

Question 6

Which THREE are differences between a hot site and a cold site? (Select three.)

Accepted Answer

Hot site is more expensive to maintain. A hot site is a fully operational, mirrored environment with real-time data synchronization, pre-installed hardware, and active network connectivity, making it significantly more expensive to maintain due to ongoing costs for power, cooling, bandwidth, and dedicated staff. In contrast, a cold site is a bare facility with no active infrastructure, requiring manual setup and provisioning before recovery can begin. The higher cost of a hot site is justified by its near-zero Recovery Time Objective (RTO), whereas a cold site's lower cost reflects its much longer RTO.

Answer

Cold site has pre-installed software and applications

Answer

Both have the same recovery time objective (RTO)

Question 7

Refer to the exhibit. Based on the backup log, what is the most likely corrective action?

Accepted Answer

Add more storage space to the backup target. The final error indicates insufficient storage space. Adding more storage space to the backup target would resolve the issue. The earlier tape error may be a symptom of full storage.

Answer

Reschedule the backup for a later time

Answer

Check network connectivity

Answer

Replace the tape drive

Question 8

Refer to the exhibit. Which statement best describes compliance with the recovery objectives?

Accepted Answer

Compliant with RTO but not RPO. The exhibit shows the required RTO is 4 hours and the actual RTO is 4 hours, meaning the system recovers within the allowed downtime, so it is compliant with RTO. However, the backup interval is 4 hours, so the actual RPO is 4 hours, which exceeds the required RPO of 1 hour. This means up to 4 hours of data could be lost, failing RPO compliance. Therefore, the correct answer is B.

Answer

Compliant with both RTO and RPO

Answer

Compliant with neither

Answer

Compliant with RPO but not RTO

Question 9

Refer to the exhibit. Based on the report, which improvement is most appropriate?

Accepted Answer

Switch to synchronous replication. Asynchronous replication can lead to data inconsistency during failover. Switching to synchronous replication ensures data consistency at the cost of some latency.

Answer

Increase backup frequency

Answer

Reduce network failover time

Answer

Implement load balancing

Question 10

A company has a disaster recovery plan that includes a hot site. Which of the following is the PRIMARY advantage of a hot site over a cold site?

Accepted Answer

Faster recovery time. A hot site is a fully operational duplicate of the primary data center, complete with live servers, storage, networking, and synchronized data. This eliminates the need to procure and configure hardware after a disaster, enabling recovery in minutes or hours rather than days or weeks. The primary advantage is therefore a significantly faster recovery time objective (RTO) compared to a cold site, which has no pre-installed equipment.

Answer

Easier maintenance

Answer

Greater security

Answer

Lower cost

Question 11

During an incident, an organization needs to preserve volatile data. Which of the following should be collected FIRST?

Accepted Answer

Memory contents. Volatile data is lost when the system loses power. Memory content is the most volatile.

Answer

Backup tapes

Answer

Hard drive contents

Answer

Network logs

Question 12

During a disaster recovery exercise, the team discovers that the backup site does not have the latest security patches applied. Which of the following steps should be taken FIRST?

Accepted Answer

Document the finding and assess risk. The first step in any incident or exercise finding is to document the issue and assess the risk it poses. Patching the backup site immediately (Option A) could introduce instability or conflicts with the current exercise, while shutting it down (Option B) would disrupt the DR test. By documenting and assessing risk first, the team can determine the appropriate remediation priority based on the backup site's role and the criticality of the missing patches.

Answer

Patch the backup site immediately

Answer

Shut down the backup site

Answer

Continue the exercise and note the issue

Question 13

Which of the following is the PRIMARY purpose of a business impact analysis (BIA)?

Accepted Answer

Identify critical business processes and their recovery priorities. The primary purpose of a business impact analysis (BIA) is to identify critical business processes and quantify the impact of their disruption, which directly determines recovery priorities and objectives (RTO/RPO). This output drives the business continuity and disaster recovery strategy, not asset inventory or cost estimation.

Answer

Determine the cost of implementing security controls

Answer

List all IT assets

Answer

Assign incident response roles

Question 14

An organization uses a warm site for disaster recovery. Which of the following is the MOST significant risk of this approach?

Accepted Answer

Data may not be synchronized with the primary site. A warm site has infrastructure and connectivity ready but does not maintain real-time data synchronization with the primary site. The most significant risk is that data may not be synchronized, meaning the Recovery Point Objective (RPO) could be hours or days old, leading to potential data loss during failover. Unlike a hot site with synchronous replication, a warm site typically uses periodic backups or asynchronous replication, creating a gap in data currency.

Answer

The site may be too far away

Answer

The site may not have recent data

Answer

High cost of maintaining duplicate hardware

Question 15

During a disaster recovery test, the team discovers that the backup generator fails to start. What is the BEST immediate action?

Accepted Answer

Document the issue and proceed. The immediate priority during a disaster recovery test is to document the failure and continue the test to evaluate the remaining components of the DR plan. The backup generator failure is a specific issue that should be logged for post-test remediation, but aborting the test prematurely would lose valuable data on other failover mechanisms, such as UPS runtime, network redundancy, or application recovery. Proceeding with documentation ensures the test's integrity while capturing the incident for root cause analysis.

Answer

Continue the test with manual procedures

Answer

Cancel the test

Answer

Shut down the data center