ISC2 CC Business Continuity, DR & Incident Response — Timed 40 Questions

Question 1

An organization's recovery time objective (RTO) for its customer database is 4 hours. During a disaster, the backup restore process takes 2 hours, but reconfigure and test tasks add another 3 hours. Which action best addresses this gap?

40 minute time limit — choose an answer to begin.

Accepted Answer

Automate the configuration and validation steps after restore.. The RTO is 4 hours, but the actual recovery time is 2 hours (restore) + 3 hours (reconfigure and test) = 5 hours, exceeding the RTO by 1 hour. Automating the configuration and validation steps (option D) reduces the post-restore manual effort, bringing the total recovery time closer to or within the 4-hour RTO. This directly addresses the gap without altering the RTO or neglecting testing.

Answer

Conduct the restore test only during annual disaster recovery drills.

Answer

Reduce the recovery point objective (RPO) to minimize data loss.

Answer

Increase the RTO to 6 hours.

Question 2

A SOC analyst receives an alert indicating a user executed a PowerShell script that initiated outbound connections to an external IP. The script was delivered via email attachment. Which incident response phase is MOST appropriate for containing this threat?

Accepted Answer

Eradication phase. When an alert is received, identification has already occurred. The next step is to contain the threat, which is typically part of the eradication phase in the ISC2 CC framework. Containment activities such as isolating the system and blocking connections are performed during the eradication phase. Therefore, option B (Eradication phase) is the most appropriate for containing the threat.

Answer

Identification phase

Answer

Recovery phase

Answer

Preparation phase

Question 3

After a security incident has been contained and eradicated, which of the following should be done to improve future incident response?

Accepted Answer

Conduct a post-incident review. A post-incident review (also called a lessons-learned meeting) is the correct next step after containment and eradication because it systematically analyzes what went wrong, what worked, and what can be improved in the incident response plan. This review directly feeds into updating playbooks, refining detection rules, and adjusting security controls to prevent recurrence. Without this step, the organization misses the opportunity to close the loop on the incident lifecycle and may repeat the same mistakes.

Answer

Reinstall the operating system

Answer

Disable the affected user accounts

Answer

Delete all incident-related logs

Question 4

In a cloud environment, the security team discovers that a misconfigured cloud storage bucket has made customer data publicly accessible. After securing the bucket, what is the most important next step?

Accepted Answer

Notify affected customers. After securing a misconfigured cloud storage bucket that exposed customer data, the most important next step is to notify affected customers. This aligns with incident response best practices and regulatory requirements (e.g., GDPR, HIPAA) that mandate timely disclosure of data breaches to impacted individuals. Without notification, the organization may face legal penalties and loss of trust, even if the data is now secure.

Answer

Delete the data

Answer

Review logs to determine access

Answer

Change the storage bucket policy

Question 5

During a ransomware incident, the incident response team isolates affected systems. Which of the following is the NEXT best step?

Accepted Answer

Preserve forensic evidence from the isolated systems.. After isolating affected systems during a ransomware incident, the next best step is to preserve forensic evidence from those systems. This ensures that data such as memory dumps, logs, and encrypted files are captured intact for analysis, which is critical for understanding the attack vector, identifying the ransomware variant, and potentially recovering data without paying the ransom. Forensic preservation must occur before any remediation steps like wiping or rebuilding, as those actions would destroy the evidence needed for investigation and legal proceedings.

Answer

Wipe and rebuild all affected systems.

Answer

Notify law enforcement immediately.

Answer

Pay the ransom to restore operations quickly.

Question 6

A company's business continuity plan includes an alternate work site with full IT capabilities. Which type of recovery site does this describe?

Accepted Answer

Hot site. A hot site is a fully equipped alternate work site with all necessary IT infrastructure—servers, networking, telecommunications, and power—ready to take over operations immediately. The question specifies 'full IT capabilities,' which aligns with the hot site's purpose of enabling rapid failover with minimal downtime, typically within hours.

Answer

Mobile site

Answer

Cold site

Answer

Warm site

Question 7

An organization uses a primary data center and a backup site 500 miles away. The backup site replicates data synchronously. Which risk is MOST likely introduced by this configuration?

Accepted Answer

Increased latency for write operations. Synchronous replication requires the primary site to wait for an acknowledgment from the backup site before completing each write operation. The 500-mile distance introduces a minimum round-trip latency of approximately 8-10 ms (based on fiber optic propagation at ~200 km/ms), which directly increases the time taken for write operations. This latency impact is the most likely risk introduced by this configuration.

Answer

High recovery point objective (RPO)

Answer

Data encryption overhead

Answer

Insufficient bandwidth between sites

Question 8

Which TWO actions are appropriate during the identification phase of incident response?

Accepted Answer

Correlate alerts from multiple sources.. During the identification phase of incident response, the goal is to detect and confirm that an incident is occurring. Correlating alerts from multiple sources (e.g., IDS/IPS logs, firewall logs, and endpoint detection) helps reduce false positives and provides a clearer picture of the attack chain. Reviewing system logs for anomalies is a core detection technique that can reveal indicators of compromise (IoCs) such as unusual process execution or failed login bursts.

Answer

Conduct a post-mortem analysis.

Answer

Restore data from backups.

Answer

Disconnect affected systems from the network.

Question 9

Which THREE elements are essential components of a business continuity plan (BCP)?

Accepted Answer

Data backup schedules and procedures. Data backup schedules and procedures are essential because they ensure that critical data can be restored after a disruption. A BCP must specify the frequency of backups (e.g., daily incremental, weekly full), the retention policy, and the recovery point objective (RPO) to meet business requirements. Without defined schedules and procedures, data loss or corruption could render the recovery process ineffective.

Answer

Incident response team roster

Answer

Detailed network topology diagrams

Question 10

Based on the incident log, at which step did the incident response team contain the threat?

Accepted Answer

14:25 - Isolated WKS-045 from network. Containment is the immediate step to prevent the threat from spreading, and isolating WKS-045 from the network at 14:25 achieves this by cutting off its network connectivity. This aligns with the NIST SP 800-61 incident response lifecycle, where containment is prioritized before eradication or recovery. The log shows isolation occurred before scanning or removal, making it the correct containment action.

Answer

14:30 - Scanned system, detected Trojan.Downloader

Answer

14:45 - Removed malware via AV

Answer

14:35 - Escalated to incident handler

Question 11

Based on the backup schedule, what is the maximum potential data loss?

Accepted Answer

33 hours (data since Tuesday 01:00). Maximum potential data loss is determined by the interval between the last successful backup and the point of failure. In a differential backup scheme, each differential contains all changes since the last full backup. If the most recent differential backup fails or is unavailable, the last successful backup becomes the previous differential. Here, the backup schedule includes a full backup on Monday at 01:00 and differential backups every 12 hours starting Tuesday at 01:00 (i.e., Tuesday 01:00, Tuesday 13:00, Wednesday 01:00, etc.). To maximize potential data loss, we assume the most recent differential backup (Tuesday 13:00) is lost, so the last successful backup is the differential from Tuesday 01:00. If a failure occurs just before the next scheduled differential (Wednesday 10:00), the data loss spans from Tuesday 01:00 to Wednesday 10:00, which is 33 hours. This is the maximum possible data loss given the schedule. Answer C correctly identifies this.

Answer

9 hours (since Tuesday 01:00)

Answer

2 days (data since Monday)

Answer

1 day (data since last full backup)

Question 12

You are the incident response lead for a financial services company. At 09:00, the SOC detects unusual outbound traffic from a server in the DMZ to an external IP known to be a command-and-control (C2) server. The server runs a legacy application that cannot be patched. The server is critical for customer transactions, but an alternate manual process can sustain operations for up to 4 hours. The CTO wants to keep the server online to avoid customer impact. The CEO is concerned about data exfiltration. The compliance officer reminds you of regulatory requirements to report breaches within 72 hours. Which action should you take FIRST?

Accepted Answer

Disconnect the server from the network and activate the manual process.. The correct first action is to disconnect the server from the network and activate the manual process. This immediately stops potential data exfiltration to the C2 server and contains the incident, aligning with the NIST incident response lifecycle's containment phase. Since the server runs a legacy application that cannot be patched and the manual process can sustain operations for up to 4 hours, isolation is both feasible and necessary to prevent further compromise while maintaining business continuity.

Answer

Report the incident to the regulatory authority immediately.

Answer

Perform a forensic analysis of the server to determine the scope of compromise.

Answer

Keep the server online under close monitoring to minimize customer disruption.

Question 13

An organization experiences a ransomware attack that encrypts critical file servers. The backups are stored on a separate network segment but are also encrypted. The incident response team suspects the attacker compromised the backup system using stored credentials. Which best practice should have been implemented to prevent this?

Accepted Answer

Enable multi-factor authentication (MFA) on backup system access. Enabling multi-factor authentication (MFA) on backup system access would have prevented the attacker from using stored credentials to compromise the backup system. MFA requires an additional authentication factor beyond just a password or stored token, making credential theft or reuse insufficient for access. This directly addresses the attack vector described—stolen credentials—rather than relying solely on network segmentation or encryption.

Answer

Implement air-gapped backups stored offline

Answer

Encrypt backup data at rest and in transit

Answer

Use a separate VLAN for backup traffic

Question 14

During a tabletop exercise for a data center outage, the IT manager realizes that the disaster recovery plan does not specify how to failover the database cluster. The primary data center fails completely. The standby site has a replica of the database, but the application team cannot promote it because they lack the necessary privileges. What is the most likely cause of this gap?

Accepted Answer

The DR plan did not include role-based access for failover operations. The scenario explicitly states that the application team lacks the necessary privileges to promote the standby database. This indicates that the disaster recovery plan did not define role-based access controls (RBAC) or assign failover permissions to specific personnel or groups. Without documented roles and privileges, even a fully replicated standby database cannot be promoted, causing a failover gap.

Answer

The standby site's network connectivity was not tested

Answer

The database replication configuration was incorrect

Answer

The database failover procedure was not documented

Question 15

Which TWO actions are most effective in reducing the mean time to detect (MTTD) a security incident?

Accepted Answer

Implementing a SIEM with centralized logging from critical systems. A SIEM with centralized logging aggregates and correlates logs from critical systems, enabling real-time analysis and automated alerting. This drastically reduces MTTD by surfacing indicators of compromise (IoCs) within minutes rather than hours or days, as manual log review would require.

Answer

Requiring multi-factor authentication for all remote access

Answer

Conducting annual security awareness training for all employees

Answer

Standardizing firewall rules across all network segments

Question 16

The exhibit shows a syslog-ng client configuration and a firewall rule on the central logging server (IP 10.0.0.10). The client (192.168.1.100) is not sending logs to the server. What is the most likely cause?

Accepted Answer

The firewall rule restricts source port 6514, but the client uses a random ephemeral source port. The firewall rule on the central logging server (10.0.0.10) specifies a source port of 6514. However, syslog-ng clients, when sending over TCP or TLS, typically use a random ephemeral source port (e.g., above 1024) rather than a fixed source port. Since the firewall restricts the source port to exactly 6514, the client's packets are dropped, preventing logs from reaching the server.

Answer

The syslog-ng configuration uses TLS, but the firewall rule does not allow TLS traffic

Answer

The syslog-ng client uses UDP by default, but the firewall allows only TCP

Answer

The firewall rule does not include the client IP 192.168.1.100

Question 17

A mid-sized e-commerce company has a primary data center in New York and a disaster recovery site in Dallas. The application stack includes a web server, application server, and a PostgreSQL database. The database uses synchronous replication to the DR site. During a routine failover test, the IT team discovers that after failing over to Dallas, the web servers in New York continue to attempt connections to the original database IP, causing application errors. The DNS records have been updated to point to the DR database IP, but the web servers are not refreshing their DNS cache. The company uses a standard TTL of 300 seconds. The IT manager needs a solution that ensures minimal disruption during future failovers. Which action should be taken?

Accepted Answer

Implement a load balancer or proxy with a virtual IP that can be switched during failover, and update the web server configuration to connect to the virtual IP. It decouples the web servers from the database IP address by introducing a load balancer or proxy with a virtual IP (VIP). During failover, the VIP is simply moved to the DR database, and the web servers continue connecting to the same VIP without any DNS dependency or cache refresh issues. This eliminates the problem of stale DNS caches and ensures minimal disruption, as the connection endpoint remains constant.

Answer

Add a static host entry in the web servers' hosts file pointing to the DR database IP

Answer

Increase the DNS TTL to 86400 seconds to ensure all caches are updated quickly

Answer

Configure the web servers to use a different DNS resolver that does not cache

Question 18

A company's primary data center experiences a complete power failure, and operations are shifted to a secondary site. The failover process takes 4 hours, but the recovery point objective (RPO) is set to 1 hour. Which of the following is the most likely consequence of this incident?

Accepted Answer

Data loss of up to 3 hours occurred.. The RPO of 1 hour means the company can tolerate losing up to 1 hour of data. Since the failover took 4 hours, any data written in the 3 hours before the power failure that had not yet been replicated to the secondary site would be lost. This results in a data loss window of up to 3 hours, exceeding the RPO.

Answer

The failover process was unsuccessful.

Answer

No data loss occurred because the secondary site was available.

Answer

The recovery time objective (RTO) was not met.

Question 19

Which TWO of the following are primary objectives of an incident response plan? (Choose two.)

Accepted Answer

Return affected systems to normal operation. A primary objective of an incident response plan is to return affected systems to normal operation. This involves containment, eradication, and recovery steps to restore business functions after a security incident, ensuring the organization can resume operations securely.

Answer

Ensure business continuity during the incident

Answer

Collect evidence for legal proceedings

Answer

Identify the root cause of the incident

Question 20

Refer to the exhibit. A security analyst observes that users from the 192.168.1.0/24 network cannot access HTTPS websites, but HTTP access works fine. What is the most likely cause?

Accepted Answer

The ACL is applied to the wrong interface or direction.. The exhibit shows an ACL that permits both HTTP (TCP 80) and HTTPS (TCP 443) inbound on the outside interface. However, the issue is that internal users cannot initiate outbound HTTPS connections. Since the ACL is applied inbound on the outside interface, it only controls incoming traffic, not outgoing. Therefore, the most likely cause is that the ACL is applied to the wrong interface or direction. The implicit deny at the end of the ACL would block any traffic not explicitly permitted, but because the ACL correctly permits HTTPS inbound, the failure of outbound HTTPS suggests a placement error. This is a common scenario where an ACL that should be applied outbound on the inside interface is mistakenly applied inbound on the outside interface, resulting in asymmetric filtering.

Answer

The implicit deny at the end of the ACL blocks HTTPS traffic.

Answer

The ACL is missing a permit statement for TCP port 443 return traffic.

Answer

The ACL explicitly denies TCP port 443.