ISC2 CC Business Continuity, Disaster Recovery, and Incident Response Practice Test 3 — 15 Questions

Question 1

A financial institution's incident response team is handling a denial-of-service (DoS) attack that is affecting customer access. The team has identified the attack source IPs and implemented filtering rules on the perimeter firewall. Which phase of incident response is being performed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Containment. Containment involves limiting the scope and impact of an incident — in this case, implementing firewall filtering rules to block attack source IPs and prevent further damage while the team investigates. This phase focuses on stopping the spread and isolating affected systems, which matches the described action. Eradication would involve removing the root cause (e.g., patching vulnerabilities), and recovery would restore normal operations.

Answer

Detection

Answer

Recovery

Answer

Eradication

Question 2

Which incident category involves an attacker tricking an employee into revealing their login credentials through a fraudulent email?

Accepted Answer

Social engineering. Social engineering is the category of incident where an attacker manipulates a person into divulging confidential information such as login credentials, typically via phishing or pretexting. A fraudulent email tricking an employee into revealing credentials is the textbook definition of social engineering, which exploits human trust rather than technical vulnerabilities.

Answer

Malware

Answer

Unauthorised access

Answer

Denial of service

Question 3

A company is creating a backup strategy for its critical database. The database is updated continuously, and the company can tolerate up to 2 hours of data loss. Which TWO backup methods would best help achieve a recovery point objective (RPO) of 2 hours? (Select TWO.)

Accepted Answer

Hourly full backups. The RPO of 2 hours means backups must capture data at least every 2 hours, so option D (Hourly full backups) is correct because running a full backup every hour guarantees a maximum data loss of 1 hour, which is within the 2-hour RPO. Option E (Transaction log backups every 30 minutes) is also correct because transaction log backups capture all committed transactions since the last log backup, limiting potential data loss to 30 minutes, well inside the 2-hour RPO, and they are the standard method for continuous-update databases. Options A (Monthly full backups) and B (Weekly full backups) are far too infrequent, allowing up to a month or a week of data loss respectively, which violates the 2-hour RPO. Option C (Daily full backups) only captures data once every 24 hours, so up to 24 hours of updates could be lost, also exceeding the 2-hour RPO.

Answer

Monthly full backups

Answer

Weekly full backups

Answer

Daily full backups

Question 4

During a security incident, the crisis communication team must notify stakeholders. According to best practices, which THREE groups should always be included in initial notifications? (Select THREE.)

Accepted Answer

Legal department. Legal department (A) must be included in initial notifications because they assess regulatory and contractual breach-notification obligations, preserve legal privilege, and guide the organization on disclosure requirements that may carry statutory deadlines. Internal management (B) is essential because executives and incident-response leadership need immediate situational awareness to authorize containment actions, allocate resources, and make business-impact decisions. Public relations (E) belongs in the initial notification group because they control the organization's external messaging, prepare holding statements, and prevent inconsistent or damaging communications while facts are still being verified. Affected customers (C) are typically notified only after the scope and impact are confirmed and legal/PR messaging is prepared, so they are not part of the initial internal notification wave. Law enforcement (D) is engaged selectively depending on the incident type, jurisdiction, and whether criminal activity or regulatory reporting mandates apply, so it is not always an initial notification recipient.

Answer

Affected customers

Answer

Law enforcement

Question 5

An organization is evaluating recovery site options. Which TWO factors are most critical when selecting between a hot site and a warm site? (Select TWO.)

Accepted Answer

Cost. Option A (Cost) is correct because a hot site is fully equipped with duplicate hardware, live data replication, and staff ready to take over almost instantly, making it far more expensive to build and maintain than a warm site, which has hardware but requires data restoration and configuration—so budget is a primary decision factor between the two. Option D (Recovery time objective, RTO) is correct because the RTO defines the maximum tolerable downtime, and a hot site typically delivers near-zero to minutes of recovery while a warm site may take hours or days; the required RTO therefore directly dictates which site type is appropriate. Geographic diversity (B) matters for any alternate site to avoid a shared disaster, but it does not distinguish a hot site from a warm site. The number of employees (C) affects capacity sizing and seat counts but is not the deciding factor between hot and warm configurations. Regulatory compliance (E) imposes requirements on the overall DR strategy but does not by itself determine whether a hot or warm site is chosen.

Answer

Geographic diversity

Answer

Number of employees

Answer

Regulatory compliance

Question 6

An organization is developing a Business Continuity Plan (BCP). Which analysis is performed first to identify critical business functions and their dependencies?

Accepted Answer

Business Impact Analysis (BIA). The Business Impact Analysis (BIA) is performed first in BCP development because it identifies critical business functions, their dependencies, and the impact of disruption over time. This data drives recovery time objectives (RTO) and recovery point objectives (RPO), which then inform the rest of the BCP. Risk assessment and other analyses come after the BIA because you must know what to protect before assessing threats to it.

Answer

Risk assessment

Answer

Vulnerability assessment

Answer

Gap analysis

Question 7

During a disaster recovery test, the IT team successfully restored systems from backups and achieved the recovery time objective (RTO). However, users could not resume normal work because additional configuration and data validation were needed. Which metric was NOT met?

Accepted Answer

Work Recovery Time (WRT). Work Recovery Time (WRT) is the time required to restore business operations after systems are technically recovered. In this scenario, systems were restored within RTO, but users could not resume work due to additional configuration and data validation, meaning WRT was not met. Therefore, WRT is the metric not met.

Answer

Recovery Point Objective (RPO)

Answer

Maximum Tolerable Downtime (MTD)

Answer

Recovery Time Objective (RTO)

Question 8

A company’s disaster recovery plan specifies an RTO of 4 hours and an RPO of 1 hour for its critical database. The database is backed up every hour using incremental backups. After a catastrophic failure, restoration takes 3 hours, but the database must be rolled forward using transaction logs. The total time to make the database fully operational is 5 hours. Which statement is correct?

Accepted Answer

RTO is exceeded but RPO is likely met. The RTO is 4 hours, but the total time to make the database fully operational is 5 hours, so RTO is exceeded. The RPO is 1 hour, and backups are taken every hour; the data loss is at most 1 hour of transactions, so RPO is likely met. Therefore, RTO is exceeded but RPO is likely met.

Answer

Both RTO and RPO are exceeded

Answer

RPO is exceeded but RTO is met

Answer

Both RTO and RPO are met

Question 9

Which recovery site strategy provides the fastest recovery time, typically within hours, and is a fully mirrored environment ready to take over operations immediately?

Accepted Answer

Hot site. A hot site is a fully mirrored recovery facility with live, synchronized data and duplicate hardware, software, and network infrastructure, enabling failover within minutes to hours. It provides the fastest recovery time among traditional site strategies and is ready to take over operations immediately. This matches the question's description of a fully mirrored, immediately available environment.

Answer

Reciprocal agreement

Answer

Warm site

Answer

Cold site

Question 10

An organization adopts the 3-2-1 backup rule. Which combination of backups satisfies this rule?

Accepted Answer

Primary storage, backup server (disk), and cloud storage. The 3-2-1 rule requires three copies of data, on two different media types, with one copy stored offsite. Option D satisfies all three: the primary storage is copy one, the on-premises disk backup server is copy two on a different medium, and cloud storage is copy three stored offsite. This combination is the canonical textbook example of a compliant 3-2-1 implementation.

Answer

Primary storage and one tape backup stored offsite

Answer

Primary storage and two tape backups in the same room

Answer

Primary storage, backup server (disk), and a second backup server (disk) in the same building

Question 11

An organization experiences a ransomware attack that encrypts critical files. The incident response team follows the standard IR phases. After containing the infection and eradicating the malware, what is the next phase?

Accepted Answer

Recovery. The standard incident response phases are Preparation, Detection and Analysis, Containment, Eradication, Recovery, and Lessons Learned. After containing the infection and eradicating the malware, the next phase is Recovery, where systems are restored to normal operation and validated before returning to production.

Answer

Detection

Answer

Preparation

Answer

Lessons learned

Question 12

Which of the following best describes a Disaster Recovery Plan (DRP)?

Accepted Answer

A plan to restore IT systems after a disruption. A Disaster Recovery Plan (DRP) is specifically focused on restoring IT systems, applications, and data after a disruption — it defines recovery time objectives (RTO), recovery point objectives (RPO), backup restoration procedures, and failover steps. It is a subset of the broader Business Continuity Plan (BCP).

Answer

A plan to evacuate personnel during an emergency

Answer

A plan to identify critical business functions

Answer

A plan to keep the business running during a disruption

Question 13

A company’s backup strategy: Full backup every Sunday, differential backups Monday through Saturday. On Thursday, the system fails. How many backups are needed to restore the data?

Accepted Answer

Two: Sunday full and Thursday differential. With a full backup on Sunday and differential backups Monday through Saturday, a restore on Thursday requires the Sunday full backup and the most recent differential (Thursday). Differential backups capture all changes since the last full backup, so only the latest differential is needed along with the full.

Answer

One: Thursday differential only

Answer

Four: Monday through Thursday differentials

Answer

Five: Monday through Thursday differentials plus full

Question 14

An organization is developing an incident response plan. Which TWO phases are part of the incident response lifecycle according to the NIST framework? (Select two.)

Accepted Answer

Preparation. Option A (Preparation) is correct because the NIST SP 800-61 incident response lifecycle begins with the Preparation phase, which covers establishing an IR capability, acquiring tools and resources, and developing policies and procedures before an incident occurs. Option C (Recovery) is correct because NIST defines Recovery as the phase in which systems are restored to normal operation, data is validated, and lessons learned are captured after containment and eradication. The other options do not belong: Business impact analysis (B) is part of business continuity planning, Risk assessment (D) is a risk management activity, and Vulnerability scanning (E) is a technical security control, none of which are named phases of the NIST incident response lifecycle.

Answer

Business impact analysis

Answer

Risk assessment

Answer

Vulnerability scanning

Question 15

A company is selecting a recovery site strategy. They need to balance cost and recovery time. Which THREE factors should they consider when choosing between hot, warm, and cold sites? (Select three.)

Accepted Answer

Cost of the facility and equipment. Option C is correct because the cost of the facility and equipment is the primary differentiator among hot, warm, and cold sites: a hot site duplicates all hardware and is fully operational (highest cost), a warm site has partial infrastructure and some pre-installed equipment (moderate cost), and a cold site provides only basic space and power (lowest cost), so this factor directly addresses the stated need to balance cost. Option D is correct because the recovery time objective (RTO) determines how quickly operations must be restored, and the site type must match that target: hot sites deliver near-zero RTO, warm sites typically hours to days, and cold sites days to weeks, making RTO the key recovery-time factor in the decision. Option E is correct because data synchronization capabilities differ by site type and affect both recovery point objective (RPO) and readiness: hot sites require real-time replication or mirroring, warm sites may use periodic backups or asynchronous replication, and cold sites rely on restoring from offsite backups, so synchronization directly influences the cost-versus-recovery-time tradeoff. Option A is not among the marked answers because geographic diversity is a general resilience and site-separation consideration that applies regardless of whether the site is hot, warm, or cold, and it is not the factor that distinguishes these three strategies. Option B is not among the marked answers because vendor lock-in risk concerns procurement and portability of technology choices, not the cost-versus-recovery-time characteristics that define hot, warm, and cold site selection.

Answer

Geographic diversity

Answer

Vendor lock-in risks