ISC2 CC Business Continuity, DR & Incident Response Practice Test 4 — 15 Questions

Question 1

Which metric defines the maximum acceptable amount of data loss measured in time?

Accepted Answer

Recovery Point Objective (RPO). The Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss measured in time, typically expressed in seconds, minutes, or hours. It represents the age of the most recent backup or replicated data that must be available to resume operations after a disaster, directly determining the frequency of backups or replication intervals.

Answer

Mean Time Between Failures (MTBF)

Answer

Mean Time to Repair (MTTR)

Answer

Recovery Time Objective (RTO)

Question 2

During a disaster recovery test, backup tapes fail to restore data due to format incompatibility. Which element of the Business Continuity Plan should be updated?

Accepted Answer

Plan testing and maintenance. The failure of backup tapes to restore data due to format incompatibility indicates that the recovery procedures and tools were not validated during testing. This directly points to a deficiency in the 'Plan testing and maintenance' element, which ensures that backup media formats, restoration tools, and procedures are regularly verified and updated to match the current production environment. Without scheduled testing and maintenance, format drift between backup software versions or hardware changes can render tapes unreadable.

Answer

Business Impact Analysis (BIA)

Answer

Recovery strategies

Answer

Communication plan

Question 3

Which is a key benefit of a cold site as a recovery location?

Accepted Answer

Low cost. A cold site is a backup facility that provides only the physical infrastructure (power, cooling, and space) but no pre-installed hardware or live data. Because it lacks equipment and requires manual setup before recovery can begin, it has the lowest capital and operational costs among recovery site options, making low cost its key benefit.

Answer

Real-time data synchronization

Answer

Reduced need for testing

Answer

Fast recovery time

Question 4

During a disaster recovery exercise, the system fails to achieve the RTO. Analysis shows that restoring the database from tape takes 3 hours, but the RTO is 2 hours. Which is the most effective solution?

Accepted Answer

Implement a hot standby database replica. The RTO (Recovery Time Objective) is a business requirement that cannot be changed by simply adjusting the backup method. A hot standby database replica (e.g., using synchronous replication or Oracle Data Guard) provides near-instant failover, reducing recovery time to minutes, which directly meets the 2-hour RTO. This solution addresses the root cause—the restore process is too slow—by eliminating the need to restore from backup entirely.

Answer

Use differential instead of full backups

Answer

Switch from tape to disk-based backups

Answer

Increase the RTO to 3 hours

Question 5

According to the NIST 800-61 incident response lifecycle, after containment and eradication have been performed, what is the next phase?

Accepted Answer

Recovery. According to the NIST 800-61 incident response lifecycle, the phases are Preparation, Detection & Analysis, Containment/Eradication, and Recovery. After containment (isolating the threat) and eradication (removing malware, patching vulnerabilities), the next phase is Recovery, where systems are carefully restored to normal operations, often using clean backups and verifying system integrity before reconnecting to the network.

Answer

Post-incident activity

Answer

Detection and analysis

Answer

Preparation

Question 6

Which statement best describes a warm site in disaster recovery?

Accepted Answer

It has hardware and network equipment but requires data restoration from backups. A warm site is a middle-ground disaster recovery option that has hardware and network infrastructure pre-installed but does not have live, synchronized data. Instead, data must be restored from backups (e.g., tape or disk snapshots) before operations can resume. This contrasts with a hot site, which maintains real-time data replication and fully active systems.

Answer

It has replicated data but no active systems

Answer

It is fully operational with real-time data synchronization

Answer

It has no hardware or infrastructure installed

Question 7

Which TWO are true about a differential backup? (Select two.)

Accepted Answer

It requires a full backup to be restored first. Option B is correct because a differential backup only contains data changed since the last full backup, so restoring requires the original full backup plus the most recent differential backup to reconstruct the complete data set. Option C is correct because a differential backup by definition copies all files that have changed since the last full backup, not since the last incremental or differential backup. Option A is incorrect because copying files changed since the last backup of any type describes an incremental backup, not a differential backup. Option D is incorrect because resetting the archive bit is characteristic of incremental backups (and some full backups), whereas differential backups do not reset the archive bit, which is why each successive differential grows larger. Option E is incorrect because a differential restore requires two restore operations (full plus differential) and is therefore not faster than restoring a single full backup.

Answer

It copies files changed since the last backup of any type

Answer

It resets the archive bit on backed-up files

Answer

It is faster to restore than a full backup

Question 8

Which THREE are differences between a hot site and a cold site? (Select three.)

Accepted Answer

Hot site is more expensive to maintain. Option A is correct because a hot site requires fully redundant, continuously powered hardware, software licenses, and network connectivity that mirror production, making its ongoing maintenance and operational costs significantly higher than a cold site's. Option C is correct because a hot site maintains real-time or near-real-time replication of data (e.g., via synchronous or asynchronous replication) so it can take over almost immediately, whereas a cold site has no such synchronization. Option E is correct because a cold site is essentially an empty facility with power, cooling, and network cabling but no pre-installed hardware or infrastructure, requiring equipment to be brought in and configured after a disaster. Option B is incorrect because pre-installed software and applications are characteristic of a hot site (or at least a warm site), not a cold site. Option D is incorrect because a hot site typically has a much lower RTO (minutes to hours) than a cold site (days to weeks), so their RTOs are not the same.

Answer

Cold site has pre-installed software and applications

Answer

Both have the same recovery time objective (RTO)

Question 9

Refer to the exhibit. Which statement best describes compliance with the recovery objectives?

Accepted Answer

Compliant with RTO but not RPO. The exhibit shows the required RTO is 4 hours and the actual RTO is 4 hours, meaning the system recovers within the allowed downtime, so it is compliant with RTO. However, the backup interval is 4 hours, so the actual RPO is 4 hours, which exceeds the required RPO of 1 hour. This means up to 4 hours of data could be lost, failing RPO compliance. Therefore, the correct answer is B.

Answer

Compliant with both RTO and RPO

Answer

Compliant with neither

Answer

Compliant with RPO but not RTO

Question 10

A company has a disaster recovery plan that includes a hot site. Which of the following is the PRIMARY advantage of a hot site over a cold site?

Accepted Answer

Faster recovery time. A hot site is a fully operational duplicate of the primary data center, complete with live servers, storage, networking, and synchronized data. This eliminates the need to procure and configure hardware after a disaster, enabling recovery in minutes or hours rather than days or weeks. The primary advantage is therefore a significantly faster recovery time objective (RTO) compared to a cold site, which has no pre-installed equipment.

Answer

Easier maintenance

Answer

Greater security

Answer

Lower cost

Question 11

During an incident, an organization needs to preserve volatile data. Which of the following should be collected FIRST?

Accepted Answer

Memory contents. Volatile data is lost when the system loses power. Memory content is the most volatile.

Answer

Backup tapes

Answer

Hard drive contents

Answer

Network logs

Question 12

During a disaster recovery exercise, the team discovers that the backup site does not have the latest security patches applied. Which of the following steps should be taken FIRST?

Accepted Answer

Document the finding and assess risk. The first step in any incident or exercise finding is to document the issue and assess the risk it poses. Patching the backup site immediately (Option A) could introduce instability or conflicts with the current exercise, while shutting it down (Option B) would disrupt the DR test. By documenting and assessing risk first, the team can determine the appropriate remediation priority based on the backup site's role and the criticality of the missing patches.

Answer

Patch the backup site immediately

Answer

Shut down the backup site

Answer

Continue the exercise and note the issue

Question 13

Which of the following is the PRIMARY purpose of a business impact analysis (BIA)?

Accepted Answer

Identify critical business processes and their recovery priorities. The primary purpose of a business impact analysis (BIA) is to identify critical business processes and quantify the impact of their disruption, which directly determines recovery priorities and objectives (RTO/RPO). This output drives the business continuity and disaster recovery strategy, not asset inventory or cost estimation.

Answer

Determine the cost of implementing security controls

Answer

List all IT assets

Answer

Assign incident response roles

Question 14

After a security incident has been contained and eradicated, which of the following should be done to improve future incident response?

Accepted Answer

Conduct a post-incident review. A post-incident review (also called a lessons-learned meeting) is the correct next step after containment and eradication because it systematically analyzes what went wrong, what worked, and what can be improved in the incident response plan. This review directly feeds into updating playbooks, refining detection rules, and adjusting security controls to prevent recurrence. Without this step, the organization misses the opportunity to close the loop on the incident lifecycle and may repeat the same mistakes.

Answer

Reinstall the operating system

Answer

Disable the affected user accounts

Answer

Delete all incident-related logs

Question 15

An organization has detected a ransomware infection. What is the FIRST step in the incident response process?

Accepted Answer

Isolate affected systems. Isolating affected systems is the correct first step because containment stops the ransomware from spreading laterally to other hosts and encrypting additional data, preserving evidence and limiting blast radius. In standard incident response frameworks such as NIST SP 800-61, containment immediately follows detection and precedes eradication, recovery, and any external reporting.

Answer

Pay the ransom

Answer

Run antivirus scans

Answer

Report to law enforcement