ISC2 CC Business Continuity, Disaster Recovery, and Incident Response Practice Test 3 — 15 Questions

Question 1

An organization is preparing its Business Continuity Plan (BCP). Which process identifies critical business functions and the impact of disruptions?

Accepted Answer

Business Impact Analysis (BIA). A Business Impact Analysis (BIA) identifies critical business functions, dependencies, and the impact of disruptions, providing metrics like MTD, RTO, and RPO.

Answer

Incident Response Plan (IRP)

Answer

Disaster Recovery Plan (DRP)

Answer

Risk Assessment

Question 2

During a BIA, the maximum tolerable downtime for a critical application is determined to be 4 hours. The IT team estimates system recovery will take 2 hours, but additional manual work to reconcile data will take 1 hour. What is the Recovery Time Objective (RTO)?

Accepted Answer

2 hours. RTO is the time within which systems must be recovered to avoid unacceptable consequences. Here, the system must be back within 2 hours to meet the 4-hour MTD, but recovery includes both system restoration and work recovery. The RTO is typically the time to restore systems to a functional state, which is 2 hours.

Answer

1 hour

Answer

4 hours

Answer

3 hours

Question 3

A company has a Recovery Point Objective (RPO) of 1 hour for its financial database. It performs full backups every night at 11 PM and incremental backups every 4 hours. If the system fails at 2:30 PM, what is the maximum data loss in terms of time?

Accepted Answer

3.5 hours. The last backup was the incremental backup at 11 AM (assuming 4-hour intervals from 11 PM). The failure at 2:30 PM means data from 11 AM to 2:30 PM (3.5 hours) could be lost, which exceeds the 1-hour RPO.

Answer

1 hour

Answer

15.5 hours

Answer

1.5 hours

Question 4

Which recovery site strategy provides the fastest Recovery Time Objective (RTO), typically within hours, by maintaining a fully operational mirrored environment?

Accepted Answer

Hot site. A hot site is a fully operational facility that mirrors the production environment, allowing recovery within hours.

Answer

Cold site

Answer

Warm site

Answer

Cloud-based recovery

Question 5

A company uses a reciprocal agreement for disaster recovery. What is a primary risk of this strategy?

Accepted Answer

Both organizations may be impacted by the same disaster. In a reciprocal agreement, two organizations agree to host each other's systems. A key risk is that both may be affected by the same disaster (e.g., regional power outage) or that the partner's capacity may be insufficient.

Answer

Data confidentiality issues

Answer

Slow recovery due to lack of equipment

Answer

High cost of maintaining the agreement

Question 6

An organization needs to prioritize recovery of systems after a disaster. Which metric directly indicates the maximum acceptable outage time for a business function?

Accepted Answer

Maximum Tolerable Downtime (MTD). Maximum Tolerable Downtime (MTD) is the maximum time a business function can be unavailable before causing unacceptable harm.

Answer

Recovery Time Objective (RTO)

Answer

Recovery Point Objective (RPO)

Answer

Work Recovery Time (WRT)

Question 7

Which backup strategy offers the fastest restore time but requires the most storage space?

Accepted Answer

Full backup. A full backup copies all data, making restore fastest (only one set needed), but it consumes the most storage and time to perform.

Answer

Incremental backup

Answer

Differential backup

Answer

Snapshot backup

Question 8

A company follows the 3-2-1 backup rule. It has two full backups: one on an external hard drive in the server room and one on tape in a safe on-site. Which step should be taken to fully comply with the rule?

Accepted Answer

Store the tape copy in a secure offsite location. The 3-2-1 rule requires 3 copies, 2 different media types, and 1 offsite. Currently, there are 2 copies (both on-site) on 2 different media (external HDD and tape). To comply, a third copy must be stored offsite.

Answer

No action needed; the rule is satisfied

Answer

Use cloud storage as an additional copy

Answer

Add a third copy to the external hard drive

Question 9

During which phase of the incident response process would the team identify the root cause of a security incident?

Accepted Answer

Analysis. The analysis phase involves examining the incident to determine the root cause, scope, and impact.

Answer

Eradication

Answer

Preparation

Answer

Detection

Question 10

A company experiences a data breach involving personal data of EU residents. Under GDPR, what is the maximum time within which the organization must notify the supervisory authority?

Accepted Answer

72 hours. GDPR requires data controllers to notify the supervisory authority within 72 hours of becoming aware of a personal data breach.

Answer

48 hours

Answer

7 days

Answer

24 hours

Question 11

During an incident, a security analyst identifies a SQL injection attack. The team contains the threat by blocking the attacker's IP. Which step should be performed next in the incident response process?

Accepted Answer

Eradication. After containment, the next step is eradication to remove the root cause (e.g., fix the vulnerability) before recovery.

Answer

Detection

Answer

Lessons Learned

Answer

Recovery

Question 12

Which incident category involves an attempt to make a system or network resource unavailable to its intended users?

Accepted Answer

Denial of service. A denial of service (DoS) attack aims to disrupt service availability by overwhelming resources.

Answer

Malware

Answer

Data breach

Answer

Social engineering

Question 13

A company is implementing a backup strategy. Which TWO of the following are characteristics of incremental backups? (Choose two.)

Accepted Answer

Fast backup process. Incremental backups back up data changed since the last backup (of any type), making them fast to perform but slow to restore because multiple backup sets may be needed.

Answer

Backs up data changed since the last full backup

Answer

Fast restore process

Answer

Requires the least storage space of all backup types

Question 14

A security team is developing an incident response plan. Which THREE of the following are essential components of crisis communications during a data breach? (Choose three.)

Accepted Answer

Notifying affected customers. Crisis communications should include notifying affected customers, informing management, and complying with legal/regulatory notification requirements. Public relations is also involved, but the options focus on key stakeholders.

Answer

Revealing technical details of the attack to the public

Answer

Deleting all logs to prevent evidence leakage

Question 15

Which TWO of the following are common indicators of a potential data breach? (Choose two.)

Accepted Answer

Unauthorized access to sensitive files. Unusual outbound network traffic (e.g., data exfiltration) and unauthorized access attempts are typical signs of a breach.

Answer

Increased employee productivity

Answer

Regular software updates

Answer

Multiple failed login attempts from a single account