ISC2 CC Business Continuity, DR & Incident Response Practice Test 5 — 15 Questions

Question 1

During a disaster recovery exercise, the backup systems are not available because the storage array failed. Which of the following should be done FIRST?

Accepted Answer

Activate the disaster recovery plan. When backup systems are unavailable due to a storage array failure, the first action must be to activate the disaster recovery plan (DRP). The DRP is the predefined, documented set of procedures that guides the organization through the recovery process, including escalation, communication, and alternative recovery methods. Without activating the plan, subsequent steps like contacting vendors or restoring from tape lack coordination and may violate recovery time objectives (RTOs) and recovery point objectives (RPOs).

Answer

Contact the vendor

Answer

Restore from offsite tape

Answer

Order replacement hardware

Question 2

Refer to the exhibit. An SOC analyst pulled this log snippet. Which type of attack is most likely in progress?

Accepted Answer

DDoS attack. The log snippet shows a massive volume of incoming traffic from multiple source IPs targeting a single destination, which is characteristic of a distributed denial-of-service (DDoS) attack. The high packet rate and diverse source addresses indicate an attempt to overwhelm the target's resources, such as bandwidth or server capacity, making services unavailable to legitimate users.

Answer

Phishing

Answer

Man-in-the-middle

Answer

Insider threat

Question 3

Refer to the exhibit. An administrator needs to restore a database file from two weeks ago, but the backup log shows success. What is the most likely reason the file cannot be restored?

Accepted Answer

The backup source did not include that file. The backup log only records the success or failure of the backup job as a whole, not the inclusion of every individual file. If the database file was not selected in the backup source configuration (e.g., a file-level backup job that excluded the database directory or a volume shadow copy that did not include the file), the backup would complete successfully without backing up that file. When the administrator attempts to restore, the file is missing from the backup set, even though the job log shows success.

Answer

The retention policy deleted it

Answer

The schedule was incorrect

Answer

The encryption key changed

Question 4

Refer to the exhibit. A DBA is investigating a replication issue. What should be the FIRST action?

Accepted Answer

Verify data integrity on primary. When investigating a replication issue, the first step should be to verify data integrity on the primary database. This ensures that the source data is consistent and not corrupted, which could be the root cause of replication failures. Checking the primary helps determine whether the issue is with the data itself or with the replication process.

Answer

Restore table from backup

Answer

Reseed replication

Answer

Fail over to standby

Question 5

In incident response, which TWO are considered volatile data that should be collected first? (Select exactly 2.)

Accepted Answer

Network connections. Option B (Network connections) is correct because active connections, ARP caches, routing tables, and open sockets reside only in memory and kernel state and are lost on shutdown or reboot, making them highly volatile and requiring immediate capture with tools like netstat, ss, or netflow. Option E (Memory contents) is correct because RAM holds running processes, encryption keys, injected code, and uncommitted data that vanish when power is removed, so it must be acquired first using a memory imager such as FTK Imager or WinPmem. Option A (Hard drive contents) is not the most volatile since disk data persists across reboots and is collected later in the order of volatility. Option C (Backup tapes) is non-volatile offline media that retains data indefinitely and is not time-sensitive. Option D (System logs) may be stored on disk and, while useful, are less volatile than live network state and RAM, so they are not among the first two to collect.

Answer

Hard drive contents

Answer

Backup tapes

Answer

System logs

Question 6

A company's primary data center is destroyed by a natural disaster. The backup site has been fully synchronized but needs to be activated. Which process addresses the activation of the backup site?

Accepted Answer

Disaster Recovery Plan (DRP). The Disaster Recovery Plan (DRP) specifically outlines the procedures for activating a backup site after a primary data center failure. In this scenario, the backup site is fully synchronized but requires activation, which involves steps like DNS changes, storage array failover (e.g., using synchronous replication with a quorum witness), and network reconfiguration. The DRP is the document that contains these technical recovery steps, distinguishing it from broader continuity or incident response plans.

Answer

Risk Management Plan

Answer

Incident Response Plan (IRP)

Answer

Business Continuity Plan (BCP)

Question 7

A security analyst receives an alert of unusual network traffic from an internal host to an external IP known for command-and-control. After isolating the host, what should be the next step?

Accepted Answer

Preserve forensic evidence and analyze. Preserving forensic evidence and analyzing the host is the correct next step because incident response methodology (e.g., NIST SP 800-61) requires containment followed by evidence collection and analysis to determine the scope of compromise, identify indicators of compromise (IOCs), and understand the attack vector. Wiping or reimaging destroys volatile data (e.g., memory, running processes, network connections) and artifacts (e.g., registry keys, prefetch files, event logs) that are critical for attribution and remediation. Analysis may involve memory forensics (using tools like Volatility) and disk forensics to extract malware samples, C2 communication logs, and lateral movement traces.

Answer

Wipe the host and reinstall OS

Answer

Reimage the host from backup

Answer

Notify law enforcement

Question 8

During a tabletop exercise, the IT team realizes that the backup tapes are stored in the same building as the servers. Which risk does this highlight?

Accepted Answer

Insufficient off-site storage. Storing backup tapes in the same building as the primary servers violates the fundamental principle of geographic separation for disaster recovery. If a fire, flood, or physical security breach destroys the building, both the primary data and the backup tapes are lost simultaneously, rendering the backups useless. This directly indicates a lack of off-site storage, which is a core requirement for a viable backup strategy.

Answer

Single point of failure

Answer

Lack of redundancy

Answer

Inadequate segregation of duties

Question 9

After a ransomware attack, which team is primarily responsible for coordinating the response?

Accepted Answer

Incident Response Team. The Incident Response Team (IRT) is primarily responsible for coordinating the response to a ransomware attack because it follows a predefined incident response plan (IRP) that includes containment, eradication, and recovery procedures. The IRT typically includes security analysts, forensic experts, and system administrators who execute technical steps such as isolating affected systems, analyzing the ransomware strain, and restoring from backups. This team operates under the NIST SP 800-61 framework, ensuring a structured and rapid response to minimize damage.

Answer

Executive Management

Answer

IT Support

Answer

Legal Department

Question 10

A company's BCP requires that critical systems be restored within 2 hours of disruption. Which metric defines this?

Accepted Answer

Recovery Time Objective (RTO). The Recovery Time Objective (RTO) defines the maximum acceptable time that a system or application can be unavailable after a disruption. In this scenario, the requirement to restore critical systems within 2 hours directly specifies the RTO. It is a key metric in business continuity planning that drives the design of failover and recovery strategies.

Answer

Mean Time to Repair (MTTR)

Answer

Service Level Agreement (SLA)

Answer

Recovery Point Objective (RPO)

Question 11

Which document outlines the procedures for maintaining critical business functions during a disruption?

Accepted Answer

Business Continuity Plan. The Business Continuity Plan (BCP) is the correct answer because it specifically outlines the procedures and strategies to maintain critical business functions during a disruption. Unlike other plans that focus on IT recovery or incident response, the BCP ensures that essential business operations continue, often by leveraging alternate work sites, manual workarounds, or scaled-down processes, until normal operations can be restored.

Answer

Continuity of Operations Plan

Answer

Incident Response Plan

Answer

Disaster Recovery Plan

Question 12

During an incident, the IR team identifies that the root cause is a zero-day vulnerability. Which of the following is the best immediate action?

Accepted Answer

Implement compensating controls. When a zero-day vulnerability is the root cause, no vendor patch exists yet (option C is impossible). Rebuilding systems (option B) without addressing the vulnerability leaves them re-exposed. The best immediate action is to implement compensating controls—such as firewall rules, IDS/IPS signatures, or application-layer filtering—to mitigate the risk until a permanent fix is available. This aligns with incident response containment strategies that prioritize reducing impact while preserving forensic evidence.

Answer

Report to CERT/CC

Answer

Rebuild all affected systems

Answer

Apply a vendor patch

Question 13

Which TWO are key outputs of a Business Impact Analysis (BIA)?

Accepted Answer

List of critical business processes. A Business Impact Analysis (BIA) identifies and prioritizes the business functions whose disruption would most affect the organization, so option A, the list of critical business processes, is a core output because it establishes what must be protected and restored first. Option E, Recovery Time Objectives (RTOs), is also a key BIA output because the BIA determines the maximum tolerable downtime for each critical process, which then drives continuity and recovery planning targets. By contrast, option B (password policy) is an access-control/security governance artifact, not a BIA deliverable. Option C (network diagram) is a technical architecture document produced by network or infrastructure teams, not by a BIA. Option D (risk register) is an output of risk assessment/risk management processes, where risks are logged and tracked; while a BIA may inform risk analysis, the risk register itself is not a primary BIA output.

Answer

Password policy

Answer

Network diagram

Answer

Risk register

Question 14

Which TWO are best practices for managing backup media?

Accepted Answer

Encrypt backup data. Option A (Encrypt backup data) is correct because backups contain sensitive data at rest, and encryption protects confidentiality if media is lost, stolen, or accessed by unauthorized parties, satisfying compliance and security best practices. Option C (Store backups in a separate physical location) is correct because offsite storage ensures survivability against site-wide disasters such as fire, flood, or theft, enabling recovery even if the primary site is destroyed. Option B is wrong because keeping backups only on the same server leaves them vulnerable to the same failure, ransomware, or disaster that affects the production system. Option D is wrong because best practice is a tiered or diversified media strategy (disk, tape, cloud) based on RPO/RTO and cost, not reliance on a single media type. Option E is wrong because backups should be tested regularly — ideally after each backup cycle or at least quarterly — not just annually, since untested backups may be unusable when needed.

Answer

Keep backups on the same server for easy access

Answer

Use only tape media

Answer

Test backups annually

Question 15

Refer to the exhibit. What is the first action the incident responder should take?

Accepted Answer

Investigate the web server at 192.168.1.10. The incident responder must first investigate the web server at 192.168.1.10 to confirm whether the alert is a true positive or a false positive. Jumping to containment actions like disabling the application or blocking the IP without verification could disrupt legitimate services or overlook the root cause. The initial step in any incident response process (as per NIST SP 800-61) is to validate the alert through analysis of logs, processes, and system state.

Answer

Disable the web application

Answer

Block the source IP in firewall

Answer

Ignore the alert as false positive