ISC2 CC Business Continuity, DR & Incident Response Practice Test 5 — 15 Questions

Question 1

During an incident, the IR team identifies that the root cause is a zero-day vulnerability. Which of the following is the best immediate action?

Accepted Answer

Implement compensating controls. When a zero-day vulnerability is the root cause, no vendor patch exists yet (option C is impossible). Rebuilding systems (option B) without addressing the vulnerability leaves them re-exposed. The best immediate action is to implement compensating controls—such as firewall rules, IDS/IPS signatures, or application-layer filtering—to mitigate the risk until a permanent fix is available. This aligns with incident response containment strategies that prioritize reducing impact while preserving forensic evidence.

Answer

Report to CERT/CC

Answer

Rebuild all affected systems

Answer

Apply a vendor patch

Question 2

Which TWO are key outputs of a Business Impact Analysis (BIA)?

Accepted Answer

List of critical business processes. BIA identifies critical business processes and determines their recovery requirements, such as Recovery Time Objectives (RTO).

Answer

Password policy

Answer

Network diagram

Answer

Risk register

Question 3

Which THREE are primary phases of the incident response lifecycle?

Accepted Answer

Containment. Containment is a primary phase of the incident response lifecycle because it focuses on stopping the spread of an incident and preventing further damage. In the NIST SP 800-61 framework, containment is explicitly listed as a core phase, following detection and analysis. This phase includes actions such as isolating affected systems, blocking malicious IPs via ACLs, or disabling compromised accounts to limit the blast radius.

Answer

Forensic Analysis

Answer

Data Archiving

Question 4

Which TWO are best practices for managing backup media?

Accepted Answer

Encrypt backup data. Encrypting backup data ensures confidentiality and integrity during transit and at rest, protecting against unauthorized access if media is lost or stolen. This is a critical best practice for compliance with standards like GDPR or HIPAA, and aligns with the principle of defense in depth. Without encryption, backup media becomes a significant security vulnerability.

Answer

Keep backups on the same server for easy access

Answer

Use only tape media

Answer

Test backups annually

Question 5

Refer to the exhibit. What is the first action the incident responder should take?

Accepted Answer

Investigate the web server at 192.168.1.10. The incident responder must first investigate the web server at 192.168.1.10 to confirm whether the alert is a true positive or a false positive. Jumping to containment actions like disabling the application or blocking the IP without verification could disrupt legitimate services or overlook the root cause. The initial step in any incident response process (as per NIST SP 800-61) is to validate the alert through analysis of logs, processes, and system state.

Answer

Disable the web application

Answer

Block the source IP in firewall

Answer

Ignore the alert as false positive

Question 6

Refer to the exhibit. What does this indicate?

Accepted Answer

The source file changed during backup. The exhibit shows a backup verification failure where the checksum or hash of the source file does not match the backup copy. This typically occurs when the source file is modified during the backup process (e.g., an open file that is being written to), causing the verification algorithm to detect a mismatch. The correct answer is A because the backup software correctly identifies that the source changed, not that the backup medium or file is corrupt.

Answer

The backup medium has errors

Answer

The verification algorithm is incorrect

Answer

The backup file is corrupt

Question 7

Refer to the exhibit. What is the effect of this ACL?

Accepted Answer

HTTPS traffic from 10.0.1.0/24 to 192.168.2.100 is permitted; all other HTTPS is denied. The ACL explicitly permits HTTPS (TCP port 443) traffic from source network 10.0.1.0/24 to destination host 192.168.2.100. Since ACLs have an implicit deny all at the end, any HTTPS traffic not matching this permit statement is denied. Option C correctly states that only this specific traffic is permitted and all other HTTPS is denied.

Answer

All HTTPS traffic is permitted

Answer

Only hosts from 10.0.1.0/24 can access HTTPS on 192.168.2.100

Answer

The ACL is invalid due to ordering

Question 8

A company's primary data center is located in a region prone to hurricanes. The IT team is designing a disaster recovery plan to ensure critical applications resume within 4 hours of a declared disaster. Which of the following is the MOST appropriate recovery strategy?

Accepted Answer

Hot site with synchronous replication (RTO 1 hour, RPO near zero). A hot site with synchronous replication is the most appropriate strategy because it provides an RTO of 1 hour (well within the 4-hour requirement) and an RPO near zero, ensuring critical applications resume quickly with minimal data loss. Synchronous replication writes data to both primary and replica storage simultaneously, so in a hurricane scenario, the hot site is fully operational and ready to take over immediately.

Answer

Colocation with tape backups shipped offsite (RTO 24 hours, RPO 24 hours)

Answer

Cold site with weekly full backups (RTO 48 hours, RPO 7 days)

Answer

Warm site with daily incremental backups (RTO 6 hours, RPO 4 hours)

Question 9

Refer to the exhibit. A security analyst observes repeated outbound connection attempts from an internal server to external IP addresses on a non-standard port. What is the MOST likely interpretation?

Accepted Answer

The server is infected with malware. Repeated outbound connection attempts from an internal server to external IP addresses on a non-standard port are a classic indicator of malware command-and-control (C2) activity. Malware often uses non-standard ports to evade detection and establish outbound communication with an external attacker. This behavior is not typical of legitimate services, which use well-known ports and protocols.

Answer

The server is being used for remote desktop access

Answer

The server is performing a port scan

Answer

The server is a legitimate mail server

Question 10

A company's business continuity plan requires a maximum tolerable downtime of 2 hours for the ERP system. The current backup process takes 3 hours to restore. Which of the following is the BEST corrective action?

Accepted Answer

Implement synchronous replication. The maximum tolerable downtime (MTD) is 2 hours, but the current restore process takes 3 hours, which exceeds the MTD. Synchronous replication writes data to both primary and secondary storage simultaneously, ensuring that the secondary copy is always current and can be failed over to in seconds or minutes, not hours. This reduces the recovery time objective (RTO) to well under the required 2 hours, directly addressing the gap.

Answer

Reduce RTO to 1 hour

Answer

Increase backup frequency

Answer

Perform restoration testing quarterly

Question 11

During an incident, the incident response team discovers that an attacker has exfiltrated sensitive customer data. According to incident response best practices, whose approval is REQUIRED before contacting law enforcement?

Accepted Answer

Legal counsel. Legal counsel approval is required before contacting law enforcement because they ensure that the disclosure complies with data privacy laws (e.g., GDPR, CCPA) and does not violate chain-of-custody requirements or expose the organization to liability. The incident response team must coordinate with legal to determine the appropriate timing and scope of law enforcement involvement, as premature contact can compromise ongoing forensic investigations or breach legal agreements.

Answer

CISO

Answer

CEO

Answer

Public relations

Question 12

A company is developing a disaster recovery plan for its database server. The database is updated transactionally and cannot tolerate any data loss. Which backup strategy meets this requirement?

Accepted Answer

Continuous database mirroring. Continuous database mirroring (C) is correct because it maintains a synchronous copy of the database on a secondary server, ensuring that every committed transaction is immediately written to both servers. This provides zero data loss (RPO=0) and automatic failover, which is required for a transactional database that cannot tolerate any data loss.

Answer

Log shipping with 15-minute intervals

Answer

Full backups nightly

Answer

Differential backups every 6 hours

Question 13

An organization's incident response plan specifies containment, eradication, and recovery phases. During containment, the team isolates a compromised server from the network. However, the server is a domain controller. What is the PRIMARY risk of this action?

Accepted Answer

Loss of authentication services. Isolating a domain controller from the network prevents it from processing authentication requests (Kerberos and NTLM), which halts user logins, resource access, and group policy updates across the domain. This loss of authentication services is the primary risk because the domain controller is the authoritative source for identity verification in Active Directory.

Answer

Data loss on the server

Answer

Violation of chain of custody

Answer

Propagation of malware to other systems

Question 14

Which metric is used to define the maximum amount of data loss an organization can tolerate during a disaster?

Accepted Answer

RPO. RPO (Recovery Point Objective) defines the maximum acceptable amount of data loss measured in time, such as seconds, minutes, or hours. It determines the age of the backup or replication data that must be restored to resume normal operations after a disaster. For example, an RPO of 1 hour means the organization can tolerate losing up to 1 hour's worth of data.

Answer

RTO

Answer

SLA

Answer

MTBF

Question 15

A small business with limited budget wants to ensure critical business functions can resume within 24 hours of a disaster. Their data changes infrequently. Which recovery solution is MOST cost-effective?

Accepted Answer

Cloud backup with instant restore. Cloud backup with instant restore (Option B) is the most cost-effective solution because the business has a limited budget, data changes infrequently, and the RTO is 24 hours. Cloud backup eliminates the need for maintaining physical infrastructure, and instant restore from cloud snapshots can meet the 24-hour RTO without the high costs of a warm or hot site.

Answer

Warm site with daily backups

Answer

Cold site with monthly backups

Answer

Hot site with real-time replication