ISC2 CC Business Continuity, Disaster Recovery, and Incident Response — 40 Questions

Question 1

A company is planning its backup strategy and wants to minimize storage usage while ensuring fast restores. Which TWO backup types should the company consider as primary and secondary backups? (Select TWO)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Full backup weekly, incremental daily. To minimize storage usage while ensuring fast restores, a common strategy is to use a full backup as the primary and either incremental or differential as the secondary. Option A (full weekly + incremental daily) saves storage as incremental backups only store changes since the last backup, but restore requires the full and all incrementals. Option C (full weekly + differential daily) uses more storage than incremental but restore is faster as only the full and last differential are needed. Both strategies meet the requirements; other options either use excessive storage (B, E) or slow restore (D) or are not two-type strategies.

Answer

Full backup daily, no other backups

Answer

Full backup monthly, incremental weekly

Answer

Full backup weekly, incremental daily, and differential weekly

Question 2

A company is developing a business continuity plan. Which document identifies critical business functions and their dependencies, including the maximum acceptable downtime?

Accepted Answer

Business Impact Analysis (BIA). A Business Impact Analysis (BIA) identifies critical business functions, dependencies, and quantifies the impact of disruptions, including maximum tolerable downtime (MTD).

Answer

Disaster Recovery Plan (DRP)

Answer

Business Continuity Plan (BCP)

Answer

Incident Response Plan (IRP)

Question 3

An organization's recovery time objective (RTO) for its customer database is 4 hours, and the recovery point objective (RPO) is 1 hour. The database is backed up every hour using full backups. A disaster occurs at 2:00 PM, and the last successful backup was at 1:00 PM. The system is restored and operational at 5:30 PM, but data from 1:00 PM to 2:00 PM is lost. Which statement is correct?

Accepted Answer

Both the RTO and RPO were met.. The RTO (4 hours) was met because recovery took 3.5 hours (2:00 PM to 5:30 PM). The RPO (1 hour) was exceeded because the data loss was 1 hour (consistent with backup frequency), but the question implies the loss is exactly 1 hour; however, the backup at 1:00 PM covers up to that time, and the loss of 1 hour is within the RPO of 1 hour. Actually, the loss is from 1:00 PM to 2:00 PM = 1 hour, which meets the RPO. So both RTO and RPO were met.

Answer

The RTO was met, but the RPO was exceeded.

Answer

The RTO was exceeded, but the RPO was met.

Answer

Both the RTO and RPO were exceeded.

Question 4

During a disaster recovery test, an organization uses a warm site. The site has partially configured servers and network infrastructure but lacks recent data. The recovery team expects to have the system operational within 2 days. Which recovery metric is most directly addressed by the warm site's capabilities?

Accepted Answer

Recovery Time Objective (RTO). A warm site typically has hardware and partial configuration, allowing recovery in days. This directly impacts the recovery time objective (RTO), which is the target time for restoring systems and data.

Answer

Recovery Point Objective (RPO)

Answer

Maximum Tolerable Downtime (MTD)

Answer

Work Recovery Time (WRT)

Question 5

An organization stores backup data on a tape drive (onsite) and also replicates critical data to a cloud storage service. This practice best exemplifies which backup rule?

Accepted Answer

3-2-1 backup rule. The 3-2-1 rule requires at least three copies of data (the original plus two backups), stored on two different media types, with one copy kept offsite. In this scenario, the original live data serves as the first copy, the tape backup (onsite) is the second copy on a different medium, and the cloud backup (offsite) is the third copy on another medium, satisfying the rule.

Answer

Incremental backup strategy

Answer

Differential backup strategy

Answer

Full backup strategy

Question 6

Which recovery site strategy provides the shortest recovery time objective (RTO), typically measured in hours, by maintaining a fully mirrored environment that can be activated immediately?

Accepted Answer

Hot site. A hot site is fully configured with hardware, software, and real-time data replication, enabling recovery within hours.

Answer

Warm site

Answer

Reciprocal agreement

Answer

Cold site

Question 7

A security analyst detects unusual outbound network traffic from a server that typically only handles internal file sharing. The traffic appears to be exfiltrating sensitive data. Which phase of the incident response process should the analyst initiate next?

Accepted Answer

Analysis. After detection (phase 2), the next step is analysis to confirm the incident and understand its scope before containment.

Answer

Containment

Answer

Lessons learned

Answer

Eradication

Question 8

A company experiences a ransomware attack that encrypts all files on a file server. The IT team decides to restore the server from the most recent full backup taken 24 hours ago, followed by all differential backups taken since then. If the last full backup was on Sunday at midnight, and the attack occurs on Wednesday at 6:00 AM, with differential backups taken daily at noon, how many differential backups must be restored?

Accepted Answer

2. Differential backups contain changes since the last full backup. The last full backup was Sunday midnight. Differential backups were taken Monday noon, Tuesday noon, and Wednesday noon (but the attack was at 6 AM Wednesday, so Wednesday's backup hadn't occurred yet). So differential backups available: Monday and Tuesday. That's 2 differential backups to restore.

Answer

3

Answer

4

Answer

1

Question 9

During a data breach incident, the incident response team discovers that personally identifiable information (PII) of European Union residents was compromised. According to GDPR, what is the maximum time frame for notifying the supervisory authority?

Accepted Answer

72 hours. GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach.

Answer

48 hours

Answer

7 days

Answer

24 hours

Question 10

Which type of backup copies all data that has changed since the last full backup, regardless of any subsequent incremental or differential backups?

Accepted Answer

Differential backup. Differential backup backs up all changes since the last full backup. Incremental backs up changes since any last backup.

Answer

Full backup

Answer

Incremental backup

Answer

Synthetic full backup

Question 11

A financial institution's incident response team is handling a denial-of-service (DoS) attack that is affecting customer access. The team has identified the attack source IPs and implemented filtering rules on the perimeter firewall. Which phase of incident response is being performed?

Accepted Answer

Containment. Implementing filtering rules to stop the attack is containment, as it prevents the attack from affecting systems further.

Answer

Detection

Answer

Recovery

Answer

Eradication

Question 12

An organization's business continuity plan designates a maximum tolerable downtime (MTD) of 8 hours for its order processing system. The system's recovery time objective (RTO) is set at 4 hours, and work recovery time (WRT) is estimated at 2 hours. If a disaster occurs at 10:00 AM and the system is restored at 2:00 PM, but additional configuration and data validation take until 3:30 PM to complete, what is the total downtime and is the MTD met?

Accepted Answer

5.5 hours, MTD met. Total downtime is from 10:00 AM to 3:30 PM = 5.5 hours. MTD is 8 hours, so 5.5 hours is within MTD. However, note that RTO (4 hours) was exceeded because system restoration at 2:00 PM is 4 hours after 10:00 AM (exactly 4 hours? Actually 10 AM to 2 PM is 4 hours, so RTO exactly met. WRT is separate. MTD is met.

Answer

4 hours, MTD exceeded

Answer

4 hours, MTD met

Answer

5.5 hours, MTD exceeded

Question 13

Which incident category involves an attacker tricking an employee into revealing their login credentials through a fraudulent email?

Accepted Answer

Social engineering. Social engineering, specifically phishing, uses deception to obtain sensitive information.

Answer

Malware

Answer

Unauthorised access

Answer

Denial of service

Question 14

A company is creating a backup strategy for its critical database. The database is updated continuously, and the company can tolerate up to 2 hours of data loss. Which TWO backup methods would best help achieve a recovery point objective (RPO) of 2 hours? (Select TWO.)

Accepted Answer

Hourly full backups. To achieve an RPO of 2 hours, backups must be taken at least every 2 hours. Hourly full backups or transaction log backups (which capture changes frequently) can meet this RPO. Daily full backups alone would cause up to 24 hours of loss.

Answer

Monthly full backups

Answer

Weekly full backups

Answer

Daily full backups

Question 15

During a security incident, the crisis communication team must notify stakeholders. According to best practices, which THREE groups should always be included in initial notifications? (Select THREE.)

Accepted Answer

Legal department. Initial notifications should include internal management (for decision-making), legal (to address liability and regulatory requirements), and public relations (to manage external messaging). Affected customers may be notified later, and law enforcement is notified if required, but not always initially.

Answer

Affected customers

Answer

Law enforcement

Question 16

An organization is evaluating recovery site options. Which TWO factors are most critical when selecting between a hot site and a warm site? (Select TWO.)

Accepted Answer

Cost. The primary factors are recovery time objective (RTO) and cost. Hot sites provide fast RTO but are expensive; warm sites are cheaper but have longer RTO.

Answer

Geographic diversity

Answer

Number of employees

Answer

Regulatory compliance

Question 17

An organization is developing a Business Continuity Plan (BCP). Which analysis is performed first to identify critical business functions and their dependencies?

Accepted Answer

Business Impact Analysis (BIA). A Business Impact Analysis (BIA) identifies critical functions, dependencies, and recovery priorities, forming the foundation for the BCP.

Answer

Risk assessment

Answer

Vulnerability assessment

Answer

Gap analysis

Question 18

During a disaster recovery test, the IT team successfully restored systems from backups and achieved the recovery time objective (RTO). However, users could not resume normal work because additional configuration and data validation were needed. Which metric was NOT met?

Accepted Answer

Work Recovery Time (WRT). Work Recovery Time (WRT) is the time needed to return to normal operations after systems are restored; it is separate from RTO.

Answer

Recovery Point Objective (RPO)

Answer

Maximum Tolerable Downtime (MTD)

Answer

Recovery Time Objective (RTO)

Question 19

A company’s disaster recovery plan specifies an RTO of 4 hours and an RPO of 1 hour for its critical database. The database is backed up every hour using incremental backups. After a catastrophic failure, restoration takes 3 hours, but the database must be rolled forward using transaction logs. The total time to make the database fully operational is 5 hours. Which statement is correct?

Accepted Answer

RTO is exceeded but RPO is likely met. The RTO was exceeded (5 hours > 4 hours), but the RPO may still be met if the last backup was within 1 hour; the scenario does not indicate data loss beyond 1 hour.

Answer

Both RTO and RPO are exceeded

Answer

RPO is exceeded but RTO is met

Answer

Both RTO and RPO are met

Question 20

Which recovery site strategy provides the fastest recovery time, typically within hours, and is a fully mirrored environment ready to take over operations immediately?

Accepted Answer

Hot site. A hot site is fully configured with current data and systems, allowing recovery within hours.

Answer

Reciprocal agreement

Answer

Warm site

Answer

Cold site