ISC2 CC Business Continuity, Disaster Recovery, and Incident Response Practice Test 2 — 15 Questions

Question 1

An organization is developing a Business Continuity Plan (BCP). Which analysis is performed first to identify critical business functions and their dependencies?

Accepted Answer

Business Impact Analysis (BIA). A Business Impact Analysis (BIA) identifies critical functions, dependencies, and recovery priorities, forming the foundation for the BCP.

Answer

Risk assessment

Answer

Vulnerability assessment

Answer

Gap analysis

Question 2

During a disaster recovery test, the IT team successfully restored systems from backups and achieved the recovery time objective (RTO). However, users could not resume normal work because additional configuration and data validation were needed. Which metric was NOT met?

Accepted Answer

Work Recovery Time (WRT). Work Recovery Time (WRT) is the time needed to return to normal operations after systems are restored; it is separate from RTO.

Answer

Recovery Point Objective (RPO)

Answer

Maximum Tolerable Downtime (MTD)

Answer

Recovery Time Objective (RTO)

Question 3

A company’s disaster recovery plan specifies an RTO of 4 hours and an RPO of 1 hour for its critical database. The database is backed up every hour using incremental backups. After a catastrophic failure, restoration takes 3 hours, but the database must be rolled forward using transaction logs. The total time to make the database fully operational is 5 hours. Which statement is correct?

Accepted Answer

RTO is exceeded but RPO is likely met. The RTO was exceeded (5 hours > 4 hours), but the RPO may still be met if the last backup was within 1 hour; the scenario does not indicate data loss beyond 1 hour.

Answer

Both RTO and RPO are exceeded

Answer

RPO is exceeded but RTO is met

Answer

Both RTO and RPO are met

Question 4

Which recovery site strategy provides the fastest recovery time, typically within hours, and is a fully mirrored environment ready to take over operations immediately?

Accepted Answer

Hot site. A hot site is fully configured with current data and systems, allowing recovery within hours.

Answer

Reciprocal agreement

Answer

Warm site

Answer

Cold site

Question 5

An organization adopts the 3-2-1 backup rule. Which combination of backups satisfies this rule?

Accepted Answer

Primary storage, backup server (disk), and cloud storage. 3-2-1 rule: 3 copies of data, on 2 different media types, 1 offsite. Option A meets all: 3 copies (primary, backup server, cloud), 2 media (disk and cloud), 1 offsite (cloud).

Answer

Primary storage and one tape backup stored offsite

Answer

Primary storage and two tape backups in the same room

Answer

Primary storage, backup server (disk), and a second backup server (disk) in the same building

Question 6

A small business wants to minimize backup storage space and backup time, knowing that restoration may be slower. Which backup strategy should they choose?

Accepted Answer

Incremental backup daily. Incremental backups capture only changes since the last backup (full or incremental), saving time and space, but restoration requires all incrementals since the last full backup.

Answer

Full backup weekly and incremental daily

Answer

Full backup daily

Answer

Differential backup daily

Question 7

During an incident, the security team detects unusual outbound traffic from a server that normally does not communicate externally. The traffic appears to be encrypted and is sent to an unknown IP address. Which incident category best describes this scenario?

Accepted Answer

Data breach. Unauthorized access or data exfiltration is indicated by unusual outbound traffic to an unknown IP, suggesting a compromised server sending data externally.

Answer

Malware

Answer

Denial of service

Answer

Social engineering

Question 8

An organization experiences a ransomware attack that encrypts critical files. The incident response team follows the standard IR phases. After containing the infection and eradicating the malware, what is the next phase?

Accepted Answer

Recovery. After eradication, the next phase is recovery, where systems are restored and returned to normal operations.

Answer

Detection

Answer

Preparation

Answer

Lessons learned

Question 9

A healthcare organization suffers a data breach involving protected health information (PHI). The incident occurred on Monday, and the organization discovers it on Wednesday. Under GDPR, if the breach affects EU residents, what is the deadline for notifying the supervisory authority?

Accepted Answer

Saturday. GDPR requires notification within 72 hours of becoming aware of the breach.

Answer

Wednesday (day of discovery)

Answer

Thursday

Answer

Monday (day of breach)

Question 10

Which of the following best describes a Disaster Recovery Plan (DRP)?

Accepted Answer

A plan to restore IT systems after a disruption. A DRP focuses specifically on restoring IT systems and infrastructure after a disruption.

Answer

A plan to evacuate personnel during an emergency

Answer

A plan to identify critical business functions

Answer

A plan to keep the business running during a disruption

Question 11

A company’s backup strategy: Full backup every Sunday, differential backups Monday through Saturday. On Thursday, the system fails. How many backups are needed to restore the data?

Accepted Answer

Two: Sunday full and Thursday differential. A differential backup contains all changes since the last full backup. So you only need the full backup from Sunday and the differential from Thursday.

Answer

One: Thursday differential only

Answer

Four: Monday through Thursday differentials

Answer

Five: Monday through Thursday differentials plus full

Question 12

An organization determines that its critical financial application has a maximum tolerable downtime (MTD) of 8 hours. The recovery time objective (RTO) is set to 6 hours, and the work recovery time (WRT) is 2 hours. If the application is restored from backup in 5 hours, but additional configuration takes 3 hours, what is the total downtime, and is the MTD met?

Accepted Answer

Total downtime 8 hours, MTD met. Total downtime = restoration (5 hours) + configuration (3 hours) = 8 hours, which equals MTD of 8 hours. So MTD is met (equal to MTD is acceptable).

Answer

Total downtime 10 hours, MTD exceeded

Answer

Total downtime 8 hours, MTD exceeded

Answer

Total downtime 5 hours, MTD met

Question 13

An organization is developing an incident response plan. Which TWO phases are part of the incident response lifecycle according to the NIST framework? (Select two.)

Accepted Answer

Preparation. The NIST incident response lifecycle includes: Preparation, Detection & Analysis, Containment/Eradication/Recovery, and Post-Incident Activity (lessons learned). The correct two from options are Preparation and Recovery.

Answer

Business impact analysis

Answer

Risk assessment

Answer

Vulnerability scanning

Question 14

A company is selecting a recovery site strategy. They need to balance cost and recovery time. Which THREE factors should they consider when choosing between hot, warm, and cold sites? (Select three.)

Accepted Answer

Cost of the facility and equipment. Key factors: cost, recovery time objective (RTO), and data synchronization capabilities. Geography and vendor lock-in are considerations but not primary for site type selection.

Answer

Geographic diversity

Answer

Vendor lock-in risks

Question 15

An organization experiences a denial-of-service (DoS) attack. Which TWO actions should the incident response team take during the containment phase? (Select two.)

Accepted Answer

Disconnect affected servers from the network. Containment aims to limit damage. Filtering traffic and disconnecting affected systems are typical containment actions for a DoS attack.

Answer

Restore systems from backup

Answer

Notify law enforcement

Answer

Conduct a root cause analysis