ISC2 CC Business Continuity, DR & Incident Response Practice Test 6 — 15 Questions

Question 1

Refer to the exhibit. A security analyst observes repeated outbound connection attempts from an internal server to external IP addresses on a non-standard port. What is the MOST likely interpretation?

Accepted Answer

The server is infected with malware. Repeated outbound connection attempts from an internal server to external IP addresses on a non-standard port are a classic indicator of malware command-and-control (C2) activity. Malware often uses non-standard ports to evade detection and establish outbound communication with an external attacker. This behavior is not typical of legitimate services, which use well-known ports and protocols.

Answer

The server is being used for remote desktop access

Answer

The server is performing a port scan

Answer

The server is a legitimate mail server

Question 2

A company's business continuity plan requires a maximum tolerable downtime of 2 hours for the ERP system. The current backup process takes 3 hours to restore. Which of the following is the BEST corrective action?

Accepted Answer

Implement synchronous replication. The maximum tolerable downtime (MTD) is 2 hours, but the current restore process takes 3 hours, which exceeds the MTD. Synchronous replication writes data to both primary and secondary storage simultaneously, ensuring that the secondary copy is always current and can be failed over to in seconds or minutes, not hours. This reduces the recovery time objective (RTO) to well under the required 2 hours, directly addressing the gap.

Answer

Reduce RTO to 1 hour

Answer

Increase backup frequency

Answer

Perform restoration testing quarterly

Question 3

An organization's incident response plan specifies containment, eradication, and recovery phases. During containment, the team isolates a compromised server from the network. However, the server is a domain controller. What is the PRIMARY risk of this action?

Accepted Answer

Loss of authentication services. Isolating a domain controller from the network prevents it from processing authentication requests (Kerberos and NTLM), which halts user logins, resource access, and group policy updates across the domain. This loss of authentication services is the primary risk because the domain controller is the authoritative source for identity verification in Active Directory.

Answer

Data loss on the server

Answer

Violation of chain of custody

Answer

Propagation of malware to other systems

Question 4

Which metric is used to define the maximum amount of data loss an organization can tolerate during a disaster?

Accepted Answer

RPO. RPO (Recovery Point Objective) defines the maximum acceptable amount of data loss measured in time, such as seconds, minutes, or hours. It determines the age of the backup or replication data that must be restored to resume normal operations after a disaster. For example, an RPO of 1 hour means the organization can tolerate losing up to 1 hour's worth of data.

Answer

RTO

Answer

SLA

Answer

MTBF

Question 5

Which TWO are essential elements of a business impact analysis (BIA)?

Accepted Answer

Identification of critical business functions. Option C is correct because a BIA must identify the critical business functions (and the processes and resources supporting them) so that recovery priorities, dependencies, and RTO/RPO targets can be established. Option E is correct because the BIA must determine the maximum acceptable outage (MAO), also expressed as maximum tolerable downtime (MTD), which sets the upper limit of tolerable disruption and drives the recovery time objective (RTO) and continuity strategies. Options A, B, and D are not essential BIA elements: a network topology diagram is a technical/infrastructure artifact used in DR planning, a list of all employees is an HR record rather than an impact analysis input, and IP address assignment is a network administration task unrelated to assessing business impact.

Answer

A network topology diagram

Answer

List of all employees

Answer

Assignment of IP addresses

Question 6

Which TWO are appropriate methods to test a disaster recovery plan?

Accepted Answer

Parallel test. A parallel test (A) is a recognized DR testing method in which the recovery site is brought online and processes data alongside the primary production site without cutting over live operations, so recovery capability is validated with minimal risk to the business. A simulation test (D) is also a standard DR testing approach, typically a tabletop or walkthrough exercise where the team rehearses roles, procedures, and decision-making for a disaster scenario without actually activating recovery systems. Regression testing (B) is a software quality technique that re-runs existing test cases to confirm changes did not break prior functionality, so it does not validate disaster recovery. Acceptance testing (C) verifies that a system meets business or user requirements before go-live, not the organization's ability to recover from a disaster. Unit testing (E) validates individual code components in isolation and has no bearing on DR plan validation.

Answer

Regression test

Answer

Acceptance test

Answer

Unit test

Question 7

Which THREE are phases of the incident response process according to NIST SP 800-61?

Accepted Answer

Containment, Eradication, and Recovery. NIST SP 800-61 defines the incident response life cycle with four phases, three of which appear here. Option D, Preparation, is the first phase, covering establishing an incident response capability, acquiring tools and resources, and developing policies before incidents occur. Option C, Detection and Analysis, is the second phase, where events are monitored, indicators are validated, and incidents are confirmed and scoped. Option A, Containment, Eradication, and Recovery, is the third phase, where the incident is limited, the root cause removed, and systems restored to normal operation. The remaining options are not phases in the NIST SP 800-61 life cycle: Risk Assessment (B) is a broader risk management activity, and Vendor Management (E) is an organizational/procurement practice, neither of which is one of the defined incident response phases.

Answer

Risk Assessment

Answer

Vendor Management

Question 8

A healthcare organization experiences a ransomware attack that encrypts all files on file servers and workstations. The incident response team has isolated the infected systems. The backup policy includes daily incremental backups and weekly full backups stored on a separate network segment. The most recent full backup is 5 days old. The incremental backups from the past 4 days are available but are stored on the same backup server that might be compromised. To restore data with minimal loss, what should the team do?

Accepted Answer

First verify the integrity of the backups by scanning them on an isolated system, then restore the full backup and apply the most recent clean incremental backups.. The correct approach is to verify backup integrity on an isolated system before restoring, because the backup server may be compromised by the same ransomware. Once verified clean, the team restores the weekly full backup and then applies the most recent clean incremental backups to minimize data loss. This balances recovery point objective (RPO) with security assurance.

Answer

Use the most recent incremental backup to restore files directly.

Answer

Assume all backups are compromised and rebuild systems from scratch.

Answer

Restore the weekly full backup and then apply all incremental backups from the past 5 days.

Question 9

A company is developing a business continuity plan (BCP). Which TWO of the following are essential components that must be included in a BCP?

Accepted Answer

Business Impact Analysis (BIA). Option C, Business Impact Analysis (BIA), is essential because it identifies critical business functions, quantifies the operational and financial impact of their disruption, and establishes the priorities and dependencies that drive the entire BCP strategy. Option D, Recovery Time Objective (RTO), is essential because it defines the maximum acceptable downtime for each critical process, directly shaping the recovery strategies, resource allocation, and backup/replication design documented in the BCP. Options A, B, and E are supporting inputs rather than mandatory BCP components: an asset inventory and network diagram are useful technical references, and a vulnerability assessment belongs to risk assessment activities that inform, but are not part of, the core BCP structure.

Answer

Asset inventory

Answer

Vulnerability assessment

Answer

Network diagram

Question 10

A multinational financial services organization operates three data centers in different geographic regions. Each data center runs a mix of critical and non-critical applications. The DR plan specifies Recovery Time Objectives (RTOs) ranging from 4 hours for critical applications to 72 hours for non-critical. During a scheduled DR test, the team attempts to fail over the primary customer database to the secondary site. The failover fails because the replication link between sites was saturated due to a large data synchronization job running concurrently. The test is declared a failure, and senior management is concerned about the DR plan's reliability. The IT director suggests increasing bandwidth between sites. The security architect proposes implementing network prioritization for replication traffic. The business continuity manager recommends revising the RTOs to be more realistic based on current bandwidth. The system administrator thinks the issue will resolve if the test is repeated during off-peak hours. Which of the following is the BEST course of action to address the root cause of the failure?

Accepted Answer

Implement Quality of Service (QoS) policies to prioritize database replication traffic over other data transfers.. The root cause is that the replication link was saturated by a large data synchronization job, which delayed the critical database replication traffic needed to meet the 4-hour RTO. Implementing Quality of Service (QoS) policies directly addresses this by prioritizing database replication traffic over other data transfers, ensuring that critical replication gets the necessary bandwidth even during concurrent large jobs. This is the most effective solution because it resolves the contention without requiring additional bandwidth or changing RTOs.

Answer

Increase the bandwidth on the replication link by ordering a faster circuit from the ISP.

Answer

Reschedule the next DR test to occur during a scheduled maintenance window with no other replication activity.

Answer

Revise the RTO for the customer database from 4 hours to 8 hours to account for current bandwidth limitations.

Question 11

A mid-sized hospital experiences a ransomware outbreak that encrypts its electronic health record (EHR) servers on a Friday night. The incident response plan designates a severity classification of 'Critical'. According to established incident response practices, which action should the incident response team take FIRST?

Accepted Answer

Isolate the affected systems from the network to contain the spread while preserving evidence. The first priority in an active ransomware incident is to contain the spread while preserving evidence, so isolating affected systems from the network is the correct initial action. Containment prevents further encryption of shared resources and backup repositories. It also keeps the systems in a state suitable for forensic analysis, which is needed to determine scope and root cause before eradication and recovery efforts begin.

Answer

Restore the EHR servers from the most recent backup immediately so clinical operations can resume

Answer

Notify all hospital staff and patients about the breach before taking any technical action

Answer

Immediately power down all affected EHR servers to stop the encryption from spreading further

Question 12

A financial services firm conducts an annual test of its business continuity plan. Management wants to evaluate how well the team performs its roles and procedures during a simulated disruption without actually moving operations to alternate sites. Which type of exercise BEST meets this requirement?

Accepted Answer

A simulation exercise that tests the team's execution of procedures without activating alternate sites. A simulation or functional exercise tests the team's ability to execute procedures and fulfill roles in a realistic scenario without the expense and disruption of activating alternate sites. It bridges the gap between discussion-based tabletop exercises and full-scale exercises by focusing on operational performance. This matches management's requirement to evaluate team performance while keeping operations in place.

Answer

A tabletop exercise where participants discuss their roles and responses to a simulated scenario

Answer

A full-scale exercise that activates the alternate processing site and relocates critical staff

Answer

A structured walkthrough in which each team member reviews the plan document individually

Question 13

A mid-sized law firm experiences a ransomware attack that encrypts its document management system. The IT director wants to ensure the firm can resume operations quickly. Which of the following BEST describes the primary purpose of a disaster recovery plan in this scenario?

Accepted Answer

To restore IT infrastructure and critical data after a disruption. A disaster recovery plan is specifically designed to restore IT infrastructure, applications, and data after a disruption. In a ransomware scenario, the plan details how to recover encrypted systems from backups, rebuild servers, and verify data integrity. The other options describe asset classification, HR discipline, and media communication, which are not the primary focus of disaster recovery.

Answer

To define penalties for employees who violate security policies

Answer

To identify and classify information assets by their sensitivity

Answer

To outline steps for communicating with the media during a crisis

Question 14

A financial services company's business continuity plan includes a recovery time objective (RTO) of 4 hours for its trading platform. During a recent test, the platform was restored in 6 hours. Which of the following should be the PRIMARY focus of the after-action review?

Accepted Answer

Identifying the causes of the delay and implementing improvements. When a recovery test exceeds the RTO, the after-action review must identify the root causes of the delay and implement corrective measures. This ensures the trading platform can meet its 4-hour RTO in a real disruption. Adjusting the RTO, replacing the team, or merely increasing test frequency does not address the specific performance gap revealed by the test.

Answer

Increasing the frequency of full-scale disaster recovery tests

Answer

Updating the RTO to 6 hours to match actual performance

Answer

Replacing the entire disaster recovery team

Question 15

A healthcare provider's incident response team is handling a breach of patient records. The team has contained the breach and is now eradicating the threat. Which of the following activities is MOST appropriate during the eradication phase?

Accepted Answer

Applying security patches to the vulnerable server. During eradication, the incident response team focuses on eliminating the root cause of the incident, such as patching vulnerabilities, removing malware, and disabling compromised accounts. Applying security patches to the vulnerable server directly addresses the flaw that enabled the breach. Notification, restoration, and lessons-learned are activities for later phases.

Answer

Restoring patient records from a clean backup

Answer

Conducting a lessons-learned meeting with the incident response team

Answer

Notifying affected patients about the data breach