ISC2 CC Business Continuity, Disaster Recovery, and Incident Response Practice Test 3 — 15 Questions

Question 1

An organization experiences a denial-of-service (DoS) attack. Which TWO actions should the incident response team take during the containment phase? (Select two.)

Accepted Answer

Disconnect affected servers from the network. Containment aims to limit damage. Filtering traffic and disconnecting affected systems are typical containment actions for a DoS attack.

Answer

Restore systems from backup

Answer

Notify law enforcement

Answer

Conduct a root cause analysis

Question 2

An organization is preparing its Business Continuity Plan (BCP). Which process identifies critical business functions and the impact of disruptions?

Accepted Answer

Business Impact Analysis (BIA). A Business Impact Analysis (BIA) identifies critical business functions, dependencies, and the impact of disruptions, providing metrics like MTD, RTO, and RPO.

Answer

Incident Response Plan (IRP)

Answer

Disaster Recovery Plan (DRP)

Answer

Risk Assessment

Question 3

During a BIA, the maximum tolerable downtime for a critical application is determined to be 4 hours. The IT team estimates system recovery will take 2 hours, but additional manual work to reconcile data will take 1 hour. What is the Recovery Time Objective (RTO)?

Accepted Answer

2 hours. RTO is the time within which systems must be recovered to avoid unacceptable consequences. Here, the system must be back within 2 hours to meet the 4-hour MTD, but recovery includes both system restoration and work recovery. The RTO is typically the time to restore systems to a functional state, which is 2 hours.

Answer

1 hour

Answer

4 hours

Answer

3 hours

Question 4

A company has a Recovery Point Objective (RPO) of 1 hour for its financial database. It performs full backups every night at 11 PM and incremental backups every 4 hours. If the system fails at 2:30 PM, what is the maximum data loss in terms of time?

Accepted Answer

3.5 hours. The last backup was the incremental backup at 11 AM (assuming 4-hour intervals from 11 PM). The failure at 2:30 PM means data from 11 AM to 2:30 PM (3.5 hours) could be lost, which exceeds the 1-hour RPO.

Answer

1 hour

Answer

15.5 hours

Answer

1.5 hours

Question 5

Which recovery site strategy provides the fastest Recovery Time Objective (RTO), typically within hours, by maintaining a fully operational mirrored environment?

Accepted Answer

Hot site. A hot site is a fully operational facility that mirrors the production environment, allowing recovery within hours.

Answer

Cold site

Answer

Warm site

Answer

Cloud-based recovery

Question 6

A company uses a reciprocal agreement for disaster recovery. What is a primary risk of this strategy?

Accepted Answer

Both organizations may be impacted by the same disaster. In a reciprocal agreement, two organizations agree to host each other's systems. A key risk is that both may be affected by the same disaster (e.g., regional power outage) or that the partner's capacity may be insufficient.

Answer

Data confidentiality issues

Answer

Slow recovery due to lack of equipment

Answer

High cost of maintaining the agreement

Question 7

An organization needs to prioritize recovery of systems after a disaster. Which metric directly indicates the maximum acceptable outage time for a business function?

Accepted Answer

Maximum Tolerable Downtime (MTD). Maximum Tolerable Downtime (MTD) is the maximum time a business function can be unavailable before causing unacceptable harm.

Answer

Recovery Time Objective (RTO)

Answer

Recovery Point Objective (RPO)

Answer

Work Recovery Time (WRT)

Question 8

Which backup strategy offers the fastest restore time but requires the most storage space?

Accepted Answer

Full backup. A full backup copies all data, making restore fastest (only one set needed), but it consumes the most storage and time to perform.

Answer

Incremental backup

Answer

Differential backup

Answer

Snapshot backup

Question 9

A company follows the 3-2-1 backup rule. It has two full backups: one on an external hard drive in the server room and one on tape in a safe on-site. Which step should be taken to fully comply with the rule?

Accepted Answer

Store the tape copy in a secure offsite location. The 3-2-1 rule requires three copies of data (including the original), stored on at least two different media types, with at least one copy stored offsite. Currently, the company has the original data plus two backups (external HDD and tape) — three copies total — but both backups are on-site. To fully comply, one of the backup copies must be moved to an offsite location. Option B, storing the tape copy offsite, satisfies the '1 offsite' requirement.

Answer

No action needed; the rule is satisfied

Answer

Use cloud storage as an additional copy

Answer

Add a third copy to the external hard drive

Question 10

During which phase of the incident response process would the team identify the root cause of a security incident?

Accepted Answer

Analysis. The analysis phase involves examining the incident to determine the root cause, scope, and impact.

Answer

Eradication

Answer

Preparation

Answer

Detection

Question 11

A company experiences a data breach involving personal data of EU residents. Under GDPR, what is the maximum time within which the organization must notify the supervisory authority?

Accepted Answer

72 hours. GDPR requires data controllers to notify the supervisory authority within 72 hours of becoming aware of a personal data breach.

Answer

48 hours

Answer

7 days

Answer

24 hours

Question 12

During an incident, a security analyst identifies a SQL injection attack. The team contains the threat by blocking the attacker's IP. Which step should be performed next in the incident response process?

Accepted Answer

Eradication. After containment, the next step is eradication to remove the root cause (e.g., fix the vulnerability) before recovery.

Answer

Detection

Answer

Lessons Learned

Answer

Recovery

Question 13

Which incident category involves an attempt to make a system or network resource unavailable to its intended users?

Accepted Answer

Denial of service. A denial of service (DoS) attack aims to disrupt service availability by overwhelming resources.

Answer

Malware

Answer

Data breach

Answer

Social engineering

Question 14

A company is implementing a backup strategy. Which TWO of the following are characteristics of incremental backups? (Choose two.)

Accepted Answer

Fast backup process. Incremental backups back up data changed since the last backup (of any type), making them fast to perform but slow to restore because multiple backup sets may be needed.

Answer

Backs up data changed since the last full backup

Answer

Fast restore process

Answer

Requires the least storage space of all backup types

Question 15

A security team is developing an incident response plan. Which THREE of the following are essential components of crisis communications during a data breach? (Choose three.)

Accepted Answer

Notifying affected customers. Crisis communications should include notifying affected customers, informing management, and complying with legal/regulatory notification requirements. Public relations is also involved, but the options focus on key stakeholders.

Answer

Revealing technical details of the attack to the public

Answer

Deleting all logs to prevent evidence leakage