ISC2 CC Business Continuity, DR & Incident Response Practice Test 4 — 15 Questions

Question 1

An organization has detected a ransomware infection. What is the FIRST step in the incident response process?

Accepted Answer

Isolate affected systems. Containment is the immediate priority to prevent further spread of the ransomware.

Answer

Pay the ransom

Answer

Run antivirus scans

Answer

Report to law enforcement

Question 2

During a disaster recovery exercise, the backup systems are not available because the storage array failed. Which of the following should be done FIRST?

Accepted Answer

Activate the disaster recovery plan. When backup systems are unavailable due to a storage array failure, the first action must be to activate the disaster recovery plan (DRP). The DRP is the predefined, documented set of procedures that guides the organization through the recovery process, including escalation, communication, and alternative recovery methods. Without activating the plan, subsequent steps like contacting vendors or restoring from tape lack coordination and may violate recovery time objectives (RTOs) and recovery point objectives (RPOs).

Answer

Contact the vendor

Answer

Restore from offsite tape

Answer

Order replacement hardware

Question 3

Refer to the exhibit. An SOC analyst pulled this log snippet. Which type of attack is most likely in progress?

Accepted Answer

DDoS attack. The log snippet shows a massive volume of incoming traffic from multiple source IPs targeting a single destination, which is characteristic of a distributed denial-of-service (DDoS) attack. The high packet rate and diverse source addresses indicate an attempt to overwhelm the target's resources, such as bandwidth or server capacity, making services unavailable to legitimate users.

Answer

Phishing

Answer

Man-in-the-middle

Answer

Insider threat

Question 4

Refer to the exhibit. An administrator needs to restore a database file from two weeks ago, but the backup log shows success. What is the most likely reason the file cannot be restored?

Accepted Answer

The backup source did not include that file. The backup log only records the success or failure of the backup job as a whole, not the inclusion of every individual file. If the database file was not selected in the backup source configuration (e.g., a file-level backup job that excluded the database directory or a volume shadow copy that did not include the file), the backup would complete successfully without backing up that file. When the administrator attempts to restore, the file is missing from the backup set, even though the job log shows success.

Answer

The retention policy deleted it

Answer

The schedule was incorrect

Answer

The encryption key changed

Question 5

Refer to the exhibit. A DBA is investigating a replication issue. What should be the FIRST action?

Accepted Answer

Verify data integrity on primary. Checksum mismatch indicates data corruption on one side. The first step is to verify data integrity on the primary to determine which copy is correct.

Answer

Restore table from backup

Answer

Reseed replication

Answer

Fail over to standby

Question 6

Which TWO are phases of the NIST incident response life cycle? (Select exactly 2.)

Accepted Answer

Preparation. Preparation is the first phase of the NIST SP 800-61 incident response life cycle, focusing on establishing policies, tools, and training before an incident occurs. This phase ensures the organization is ready to detect and respond to security events effectively.

Answer

Documentation

Answer

Assessment

Answer

Authorization

Question 7

Which THREE are commonly defined in a disaster recovery plan? (Select exactly 3.)

Accepted Answer

Recovery point objective. Recovery point objective (RPO) is a core metric defined in a disaster recovery plan because it specifies the maximum acceptable amount of data loss measured in time. For example, an RPO of 1 hour means backups must be taken at least every hour to ensure no more than 60 minutes of data is lost. This directly drives backup frequency and replication technology choices, such as synchronous vs. asynchronous replication.

Answer

Cost-benefit analysis

Answer

Annual loss expectancy

Question 8

In incident response, which TWO are considered volatile data that should be collected first? (Select exactly 2.)

Accepted Answer

Network connections. Network connections (option B) are volatile because they represent active communication channels that disappear when the system is powered off or disconnected. In incident response, collecting network connection data (e.g., using netstat -an) first preserves evidence of ongoing malicious activity, such as command-and-control (C2) traffic or lateral movement, before it is lost.

Answer

Hard drive contents

Answer

Backup tapes

Answer

System logs

Question 9

A company's primary data center is destroyed by a natural disaster. The backup site has been fully synchronized but needs to be activated. Which process addresses the activation of the backup site?

Accepted Answer

Disaster Recovery Plan (DRP). The Disaster Recovery Plan (DRP) specifically outlines the procedures for activating a backup site after a primary data center failure. In this scenario, the backup site is fully synchronized but requires activation, which involves steps like DNS changes, storage array failover (e.g., using synchronous replication with a quorum witness), and network reconfiguration. The DRP is the document that contains these technical recovery steps, distinguishing it from broader continuity or incident response plans.

Answer

Risk Management Plan

Answer

Incident Response Plan (IRP)

Answer

Business Continuity Plan (BCP)

Question 10

A security analyst receives an alert of unusual network traffic from an internal host to an external IP known for command-and-control. After isolating the host, what should be the next step?

Accepted Answer

Preserve forensic evidence and analyze. Preserving forensic evidence and analyzing the host is the correct next step because incident response methodology (e.g., NIST SP 800-61) requires containment followed by evidence collection and analysis to determine the scope of compromise, identify indicators of compromise (IOCs), and understand the attack vector. Wiping or reimaging destroys volatile data (e.g., memory, running processes, network connections) and artifacts (e.g., registry keys, prefetch files, event logs) that are critical for attribution and remediation. Analysis may involve memory forensics (using tools like Volatility) and disk forensics to extract malware samples, C2 communication logs, and lateral movement traces.

Answer

Wipe the host and reinstall OS

Answer

Reimage the host from backup

Answer

Notify law enforcement

Question 11

During a tabletop exercise, the IT team realizes that the backup tapes are stored in the same building as the servers. Which risk does this highlight?

Accepted Answer

Insufficient off-site storage. Storing backup tapes in the same building as the primary servers violates the fundamental principle of geographic separation for disaster recovery. If a fire, flood, or physical security breach destroys the building, both the primary data and the backup tapes are lost simultaneously, rendering the backups useless. This directly indicates a lack of off-site storage, which is a core requirement for a viable backup strategy.

Answer

Single point of failure

Answer

Lack of redundancy

Answer

Inadequate segregation of duties

Question 12

After a ransomware attack, which team is primarily responsible for coordinating the response?

Accepted Answer

Incident Response Team. The Incident Response Team (IRT) is primarily responsible for coordinating the response to a ransomware attack because it follows a predefined incident response plan (IRP) that includes containment, eradication, and recovery procedures. The IRT typically includes security analysts, forensic experts, and system administrators who execute technical steps such as isolating affected systems, analyzing the ransomware strain, and restoring from backups. This team operates under the NIST SP 800-61 framework, ensuring a structured and rapid response to minimize damage.

Answer

Executive Management

Answer

IT Support

Answer

Legal Department

Question 13

A company's BCP requires that critical systems be restored within 2 hours of disruption. Which metric defines this?

Accepted Answer

Recovery Time Objective (RTO). The Recovery Time Objective (RTO) defines the maximum acceptable time that a system or application can be unavailable after a disruption. In this scenario, the requirement to restore critical systems within 2 hours directly specifies the RTO. It is a key metric in business continuity planning that drives the design of failover and recovery strategies.

Answer

Mean Time to Repair (MTTR)

Answer

Service Level Agreement (SLA)

Answer

Recovery Point Objective (RPO)

Question 14

Which document outlines the procedures for maintaining critical business functions during a disruption?

Accepted Answer

Business Continuity Plan. The Business Continuity Plan (BCP) is the correct answer because it specifically outlines the procedures and strategies to maintain critical business functions during a disruption. Unlike other plans that focus on IT recovery or incident response, the BCP ensures that essential business operations continue, often by leveraging alternate work sites, manual workarounds, or scaled-down processes, until normal operations can be restored.

Answer

Continuity of Operations Plan

Answer

Incident Response Plan

Answer

Disaster Recovery Plan

Question 15

An organization's backup strategy includes daily full backups. However, recovery tests show that restoring from tape takes 6 hours longer than expected. What is the most likely cause?

Accepted Answer

Improperly documented recovery procedures. Improperly documented recovery procedures can lead to incorrect steps or delays during restoration, which is a common cause of extended recovery times.

Answer

Tape drive failure

Answer

Inadequate storage capacity

Answer

Insufficient bandwidth