ISC2 CC Business Continuity, DR & Incident Response — Timed 15 Questions

Question 1

An organization's recovery time objective (RTO) for its customer database is 4 hours. During a disaster, the backup restore process takes 2 hours, but reconfigure and test tasks add another 3 hours. Which action best addresses this gap?

15 minute time limit — choose an answer to begin.

Accepted Answer

Automate the configuration and validation steps after restore.. The RTO is 4 hours, but the actual recovery time is 2 hours (restore) + 3 hours (reconfigure and test) = 5 hours, exceeding the RTO by 1 hour. Automating the configuration and validation steps (option D) reduces the post-restore manual effort, bringing the total recovery time closer to or within the 4-hour RTO. This directly addresses the gap without altering the RTO or neglecting testing.

Answer

Conduct the restore test only during annual disaster recovery drills.

Answer

Reduce the recovery point objective (RPO) to minimize data loss.

Answer

Increase the RTO to 6 hours.

Question 2

A SOC analyst receives an alert indicating a user executed a PowerShell script that initiated outbound connections to an external IP. The script was delivered via email attachment. Which incident response phase is MOST appropriate for containing this threat?

Accepted Answer

Eradication phase. When an alert is received, identification has already occurred. The next step is to contain the threat, which is typically part of the eradication phase in the ISC2 CC framework. Containment activities such as isolating the system and blocking connections are performed during the eradication phase. Therefore, option B (Eradication phase) is the most appropriate for containing the threat.

Answer

Identification phase

Answer

Recovery phase

Answer

Preparation phase

Question 3

After a security incident has been contained and eradicated, which of the following should be done to improve future incident response?

Accepted Answer

Conduct a post-incident review. A post-incident review (also called a lessons-learned meeting) is the correct next step after containment and eradication because it systematically analyzes what went wrong, what worked, and what can be improved in the incident response plan. This review directly feeds into updating playbooks, refining detection rules, and adjusting security controls to prevent recurrence. Without this step, the organization misses the opportunity to close the loop on the incident lifecycle and may repeat the same mistakes.

Answer

Reinstall the operating system

Answer

Disable the affected user accounts

Answer

Delete all incident-related logs

Question 4

In a cloud environment, the security team discovers that a misconfigured cloud storage bucket has made customer data publicly accessible. After securing the bucket, what is the most important next step?

Accepted Answer

Notify affected customers. After securing a misconfigured cloud storage bucket that exposed customer data, the most important next step is to notify affected customers. This aligns with incident response best practices and regulatory requirements (e.g., GDPR, HIPAA) that mandate timely disclosure of data breaches to impacted individuals. Without notification, the organization may face legal penalties and loss of trust, even if the data is now secure.

Answer

Delete the data

Answer

Review logs to determine access

Answer

Change the storage bucket policy

Question 5

During a ransomware incident, the incident response team isolates affected systems. Which of the following is the NEXT best step?

Accepted Answer

Preserve forensic evidence from the isolated systems.. After isolating affected systems during a ransomware incident, the next best step is to preserve forensic evidence from those systems. This ensures that data such as memory dumps, logs, and encrypted files are captured intact for analysis, which is critical for understanding the attack vector, identifying the ransomware variant, and potentially recovering data without paying the ransom. Forensic preservation must occur before any remediation steps like wiping or rebuilding, as those actions would destroy the evidence needed for investigation and legal proceedings.

Answer

Wipe and rebuild all affected systems.

Answer

Notify law enforcement immediately.

Answer

Pay the ransom to restore operations quickly.

Question 6

A company's business continuity plan includes an alternate work site with full IT capabilities. Which type of recovery site does this describe?

Accepted Answer

Hot site. A hot site is a fully equipped alternate work site with all necessary IT infrastructure—servers, networking, telecommunications, and power—ready to take over operations immediately. The question specifies 'full IT capabilities,' which aligns with the hot site's purpose of enabling rapid failover with minimal downtime, typically within hours.

Answer

Mobile site

Answer

Cold site

Answer

Warm site

Question 7

An organization uses a primary data center and a backup site 500 miles away. The backup site replicates data synchronously. Which risk is MOST likely introduced by this configuration?

Accepted Answer

Increased latency for write operations. Synchronous replication requires the primary site to wait for an acknowledgment from the backup site before completing each write operation. The 500-mile distance introduces a minimum round-trip latency of approximately 8-10 ms (based on fiber optic propagation at ~200 km/ms), which directly increases the time taken for write operations. This latency impact is the most likely risk introduced by this configuration.

Answer

High recovery point objective (RPO)

Answer

Data encryption overhead

Answer

Insufficient bandwidth between sites

Question 8

Which TWO actions are appropriate during the identification phase of incident response?

Accepted Answer

Correlate alerts from multiple sources.. During the identification phase of incident response, the goal is to detect and confirm that an incident is occurring. Correlating alerts from multiple sources (e.g., IDS/IPS logs, firewall logs, and endpoint detection) helps reduce false positives and provides a clearer picture of the attack chain. Reviewing system logs for anomalies is a core detection technique that can reveal indicators of compromise (IoCs) such as unusual process execution or failed login bursts.

Answer

Conduct a post-mortem analysis.

Answer

Restore data from backups.

Answer

Disconnect affected systems from the network.

Question 9

Which THREE elements are essential components of a business continuity plan (BCP)?

Accepted Answer

Data backup schedules and procedures. Data backup schedules and procedures are essential because they ensure that critical data can be restored after a disruption. A BCP must specify the frequency of backups (e.g., daily incremental, weekly full), the retention policy, and the recovery point objective (RPO) to meet business requirements. Without defined schedules and procedures, data loss or corruption could render the recovery process ineffective.

Answer

Incident response team roster

Answer

Detailed network topology diagrams

Question 10

Based on the incident log, at which step did the incident response team contain the threat?

Accepted Answer

14:25 - Isolated WKS-045 from network. Containment is the immediate step to prevent the threat from spreading, and isolating WKS-045 from the network at 14:25 achieves this by cutting off its network connectivity. This aligns with the NIST SP 800-61 incident response lifecycle, where containment is prioritized before eradication or recovery. The log shows isolation occurred before scanning or removal, making it the correct containment action.

Answer

14:30 - Scanned system, detected Trojan.Downloader

Answer

14:45 - Removed malware via AV

Answer

14:35 - Escalated to incident handler

Question 11

Based on the backup schedule, what is the maximum potential data loss?

Accepted Answer

33 hours (data since Tuesday 01:00). Maximum potential data loss is determined by the interval between the last successful backup and the point of failure. In a differential backup scheme, each differential contains all changes since the last full backup. If the most recent differential backup fails or is unavailable, the last successful backup becomes the previous differential. Here, the backup schedule includes a full backup on Monday at 01:00 and differential backups every 12 hours starting Tuesday at 01:00 (i.e., Tuesday 01:00, Tuesday 13:00, Wednesday 01:00, etc.). To maximize potential data loss, we assume the most recent differential backup (Tuesday 13:00) is lost, so the last successful backup is the differential from Tuesday 01:00. If a failure occurs just before the next scheduled differential (Wednesday 10:00), the data loss spans from Tuesday 01:00 to Wednesday 10:00, which is 33 hours. This is the maximum possible data loss given the schedule. Answer C correctly identifies this.

Answer

9 hours (since Tuesday 01:00)

Answer

2 days (data since Monday)

Answer

1 day (data since last full backup)

Question 12

You are the incident response lead for a financial services company. At 09:00, the SOC detects unusual outbound traffic from a server in the DMZ to an external IP known to be a command-and-control (C2) server. The server runs a legacy application that cannot be patched. The server is critical for customer transactions, but an alternate manual process can sustain operations for up to 4 hours. The CTO wants to keep the server online to avoid customer impact. The CEO is concerned about data exfiltration. The compliance officer reminds you of regulatory requirements to report breaches within 72 hours. Which action should you take FIRST?

Accepted Answer

Disconnect the server from the network and activate the manual process.. The correct first action is to disconnect the server from the network and activate the manual process. This immediately stops potential data exfiltration to the C2 server and contains the incident, aligning with the NIST incident response lifecycle's containment phase. Since the server runs a legacy application that cannot be patched and the manual process can sustain operations for up to 4 hours, isolation is both feasible and necessary to prevent further compromise while maintaining business continuity.

Answer

Report the incident to the regulatory authority immediately.

Answer

Perform a forensic analysis of the server to determine the scope of compromise.

Answer

Keep the server online under close monitoring to minimize customer disruption.

Question 13

An organization experiences a ransomware attack that encrypts critical file servers. The backups are stored on a separate network segment but are also encrypted. The incident response team suspects the attacker compromised the backup system using stored credentials. Which best practice should have been implemented to prevent this?

Accepted Answer

Enable multi-factor authentication (MFA) on backup system access. Enabling multi-factor authentication (MFA) on backup system access would have prevented the attacker from using stored credentials to compromise the backup system. MFA requires an additional authentication factor beyond just a password or stored token, making credential theft or reuse insufficient for access. This directly addresses the attack vector described—stolen credentials—rather than relying solely on network segmentation or encryption.

Answer

Implement air-gapped backups stored offline

Answer

Encrypt backup data at rest and in transit

Answer

Use a separate VLAN for backup traffic

Question 14

During a tabletop exercise for a data center outage, the IT manager realizes that the disaster recovery plan does not specify how to failover the database cluster. The primary data center fails completely. The standby site has a replica of the database, but the application team cannot promote it because they lack the necessary privileges. What is the most likely cause of this gap?

Accepted Answer

The DR plan did not include role-based access for failover operations. The scenario explicitly states that the application team lacks the necessary privileges to promote the standby database. This indicates that the disaster recovery plan did not define role-based access controls (RBAC) or assign failover permissions to specific personnel or groups. Without documented roles and privileges, even a fully replicated standby database cannot be promoted, causing a failover gap.

Answer

The standby site's network connectivity was not tested

Answer

The database replication configuration was incorrect

Answer

The database failover procedure was not documented

Question 15

Which TWO actions are most effective in reducing the mean time to detect (MTTD) a security incident?

Accepted Answer

Implementing a SIEM with centralized logging from critical systems. A SIEM with centralized logging aggregates and correlates logs from critical systems, enabling real-time analysis and automated alerting. This drastically reduces MTTD by surfacing indicators of compromise (IoCs) within minutes rather than hours or days, as manual log review would require.

Answer

Requiring multi-factor authentication for all remote access

Answer

Conducting annual security awareness training for all employees

Answer

Standardizing firewall rules across all network segments