ISC2 CC Business Continuity, Disaster Recovery, and Incident Response — 10 Questions

Question 1

A company experiences a ransomware attack that encrypts all files on a file server. The IT team decides to restore the server from the most recent full backup taken 24 hours ago, followed by all differential backups taken since then. If the last full backup was on Sunday at midnight, and the attack occurs on Wednesday at 6:00 AM, with differential backups taken daily at noon, how many differential backups must be restored?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

2. Differential backups contain changes since the last full backup. The last full backup was Sunday midnight. Differential backups were taken Monday noon, Tuesday noon, and Wednesday noon (but the attack was at 6 AM Wednesday, so Wednesday's backup hadn't occurred yet). So differential backups available: Monday and Tuesday. That's 2 differential backups to restore.

Answer

3

Answer

4

Answer

1

Question 2

An organization's business continuity plan designates a maximum tolerable downtime (MTD) of 8 hours for its order processing system. The system's recovery time objective (RTO) is set at 4 hours, and work recovery time (WRT) is estimated at 2 hours. If a disaster occurs at 10:00 AM and the system is restored at 2:00 PM, but additional configuration and data validation take until 3:30 PM to complete, what is the total downtime and is the MTD met?

Accepted Answer

5.5 hours, MTD met. Total downtime is from disaster at 10:00 AM to full restoration at 3:30 PM, which is 5.5 hours. The MTD is 8 hours, so 5.5 hours is within the MTD, meaning the MTD is met. The RTO (4 hours) is the time to restore the system, which was 4 hours (10 AM to 2 PM), and WRT (2 hours) is additional work to validate, totaling 6 hours? Wait, 10 AM to 3:30 PM is 5.5 hours. RTO 4 hours + WRT 2 hours = 6 hours, but actual is 5.5 hours. The question asks total downtime and if MTD met. 5.5 hours < 8 hours, so met. Correct answer B.

Answer

4 hours, MTD exceeded

Answer

4 hours, MTD met

Answer

5.5 hours, MTD exceeded

Question 3

A small business wants to minimize backup storage space and backup time, knowing that restoration may be slower. Which backup strategy should they choose?

Accepted Answer

Incremental backup daily. Incremental backup daily backs up only the data changed since the last backup (whether full or incremental), minimizing backup storage space and backup time. The trade-off is that restoration requires the last full backup plus every incremental since, making restoration slower and more complex. This matches the requirement to minimize storage and time at the cost of slower restoration.

Answer

Full backup weekly and incremental daily

Answer

Full backup daily

Answer

Differential backup daily

Question 4

During an incident, the security team detects unusual outbound traffic from a server that normally does not communicate externally. The traffic appears to be encrypted and is sent to an unknown IP address. Which incident category best describes this scenario?

Accepted Answer

Data breach. Unusual encrypted outbound traffic to an unknown IP from a server that normally does not communicate externally is a classic indicator of data exfiltration, which falls under the data breach category. The encryption suggests the attacker is hiding stolen data, and the unknown destination indicates unauthorized transfer of sensitive information.

Answer

Malware

Answer

Denial of service

Answer

Social engineering

Question 5

A healthcare organization suffers a data breach involving protected health information (PHI). The incident occurred on Monday, and the organization discovers it on Wednesday. Under GDPR, if the breach affects EU residents, what is the deadline for notifying the supervisory authority?

Accepted Answer

Saturday. GDPR Article 33 requires notification of a personal data breach to the supervisory authority within 72 hours of becoming aware of it. The organization discovered the breach on Wednesday, so the deadline is 72 hours later — Saturday. The clock starts at awareness, not at the time the breach occurred, which is why the Monday breach date is irrelevant to the deadline calculation.

Answer

Wednesday (day of discovery)

Answer

Thursday

Answer

Monday (day of breach)

Question 6

An organization determines that its critical financial application has a maximum tolerable downtime (MTD) of 8 hours. The recovery time objective (RTO) is set to 6 hours, and the work recovery time (WRT) is 2 hours. If the application is restored from backup in 5 hours, but additional configuration takes 3 hours, what is the total downtime, and is the MTD met?

Accepted Answer

Total downtime 8 hours, MTD met. Total downtime is the sum of the time to restore from backup (5 hours) and the additional configuration time (3 hours), which equals 8 hours. Since the MTD is 8 hours, the downtime exactly meets the maximum tolerable downtime, so the MTD is met. The RTO (6 hours) and WRT (2 hours) sum to 8 hours, which is the maximum allowed downtime; the actual downtime of 8 hours is within the MTD.

Answer

Total downtime 10 hours, MTD exceeded

Answer

Total downtime 8 hours, MTD exceeded

Answer

Total downtime 5 hours, MTD met

Question 7

During a BIA, the maximum tolerable downtime for a critical application is determined to be 4 hours. The IT team estimates system recovery will take 2 hours, but additional manual work to reconcile data will take 1 hour. What is the Recovery Time Objective (RTO)?

Accepted Answer

2 hours. RTO is the maximum acceptable time to restore a system or application after a disruption, and it is defined by the business requirement, not by how long recovery actually takes. The BIA established an MTD of 4 hours, and the RTO is the target recovery time the business sets within that window — here, 2 hours, matching the IT team's system recovery estimate.

Answer

1 hour

Answer

4 hours

Answer

3 hours

Question 8

A company has a Recovery Point Objective (RPO) of 1 hour for its financial database. It performs full backups every night at 11 PM and incremental backups every 4 hours. If the system fails at 2:30 PM, what is the maximum data loss in terms of time?

Accepted Answer

3.5 hours. The maximum data loss is the time between the last successful backup and the failure. Full backup at 11 PM, then incremental backups every 4 hours: 3 AM, 7 AM, 11 AM, 3 PM. Since the failure occurs at 2:30 PM, the most recent backup before failure is the 11 AM incremental. Data loss is therefore from 11 AM to 2:30 PM, which is 3.5 hours. The RPO of 1 hour is a requirement, not the actual data loss; the schedule as given results in up to 3.5 hours of data loss, exceeding the RPO. Option C is correct.

Answer

1 hour

Answer

15.5 hours

Answer

1.5 hours

Question 9

An organization needs to prioritize recovery of systems after a disaster. Which metric directly indicates the maximum acceptable outage time for a business function?

Accepted Answer

Maximum Tolerable Downtime (MTD). Maximum Tolerable Downtime (MTD) is the total time a business function can be unavailable before unacceptable consequences occur — it is the maximum acceptable outage time. RTO is the target time to restore the system, which must be less than MTD, but MTD itself is the metric that directly expresses the maximum tolerable outage.

Answer

Recovery Time Objective (RTO)

Answer

Recovery Point Objective (RPO)

Answer

Work Recovery Time (WRT)

Question 10

A company is implementing a backup strategy. Which TWO of the following are characteristics of incremental backups? (Choose two.)

Accepted Answer

Fast backup process. Option D is correct because an incremental backup only captures data that has changed since the most recent backup of any kind, so the backup job itself completes quickly and consumes minimal time and resources. Option E is correct because the defining characteristic of an incremental backup is that it backs up only data changed since the last backup, whether that previous backup was full, differential, or incremental. Options A and C are incorrect: option A describes a differential backup (changed since the last full backup), and option C is inaccurate because incremental backups use less space than full backups but the claim of 'least storage space of all backup types' is not a defining characteristic and depends on the environment. Option B is incorrect because incremental backups actually require a slower, more complex restore process, since the last full backup plus every subsequent incremental backup must be applied in sequence.

Answer

Backs up data changed since the last full backup

Answer

Fast restore process

Answer

Requires the least storage space of all backup types