ISC2 CC Business Continuity, Disaster Recovery, and Incident Response Practice Test 4 — 15 Questions

Question 1

Which TWO of the following are common indicators of a potential data breach? (Choose two.)

Accepted Answer

Unauthorized access to sensitive files. Unusual outbound network traffic (e.g., data exfiltration) and unauthorized access attempts are typical signs of a breach.

Answer

Increased employee productivity

Answer

Regular software updates

Answer

Multiple failed login attempts from a single account

Question 2

A company is creating a business continuity plan. Which analysis should be performed first to identify critical business functions and their dependencies?

Accepted Answer

Business Impact Analysis (BIA). A Business Impact Analysis (BIA) is the first step in BCP to identify critical functions, dependencies, and recovery requirements.

Answer

Vulnerability assessment

Answer

Risk assessment

Answer

Gap analysis

Question 3

After a ransomware attack, the IT team restores systems from backups. The CEO asks how quickly data can be recovered. Which metric addresses the acceptable amount of data loss?

Accepted Answer

Recovery Point Objective (RPO). RPO defines the maximum acceptable data loss measured in time.

Answer

Work Recovery Time (WRT)

Answer

Recovery Time Objective (RTO)

Answer

Maximum Tolerable Downtime (MTD)

Question 4

An organization's BIA determines that the payroll system has a Maximum Tolerable Downtime (MTD) of 4 hours. The current recovery plan has an RTO of 2 hours and an RPO of 1 hour. What is the maximum Work Recovery Time (WRT) allowed to meet the MTD?

Accepted Answer

2 hours. MTD = RTO + WRT. Given MTD=4, RTO=2, so WRT ≤ 2 hours.

Answer

3 hours

Answer

4 hours

Answer

1 hour

Question 5

Which type of recovery site is pre-configured with hardware and software, but does not have live data, typically requiring days to become operational?

Accepted Answer

Warm site. A warm site has partially configured infrastructure but no current data, leading to RTO of days.

Answer

Cloud-based recovery

Answer

Cold site

Answer

Hot site

Question 6

A company uses a backup strategy where on Monday a full backup is taken, and on Tuesday only data changed since Monday is backed up. On Wednesday, the backup includes all data changed since Monday. What type of backup is the Wednesday backup?

Accepted Answer

Differential backup. Differential backup includes changes since last full backup.

Answer

Incremental backup

Answer

Synthetic full backup

Answer

Full backup

Question 7

During an incident, the incident response team identifies that a malware infection is spreading. They isolate affected systems to prevent further damage. Which phase of the incident response process are they performing?

Accepted Answer

Containment. Containment aims to limit the scope of the incident.

Answer

Recovery

Answer

Eradication

Answer

Detection

Question 8

A security analyst detects unusual outbound traffic from a server that suggests a data breach. According to GDPR, within what timeframe must the organization notify the supervisory authority?

Accepted Answer

72 hours. GDPR mandates notification within 72 hours of awareness of a breach.

Answer

48 hours

Answer

7 days

Answer

24 hours

Question 9

An organization is adopting the 3-2-1 backup rule. They currently have data on a primary server and a daily backup to an external hard drive. To comply with the rule, what is the minimum additional requirement?

Accepted Answer

A cloud backup stored offsite. 3-2-1 rule: 3 copies, 2 different media, 1 offsite. They have 2 copies on 1 media (hard drive). Need a third copy on different media and offsite.

Answer

A second external hard drive stored on-site

Answer

An incremental backup to a network share

Answer

A full backup on tape stored in the same room

Question 10

Which incident category involves an attacker tricking an employee into revealing credentials?

Accepted Answer

Social engineering. Social engineering includes phishing, pretexting, etc., to manipulate people.

Answer

Data breach

Answer

Malware

Answer

Denial of service

Question 11

During a disaster, an organization activates a reciprocal agreement with another company. What is a primary risk associated with this strategy?

Accepted Answer

Potential lack of capacity when both parties need resources simultaneously. Reciprocal agreements often fail because one party may lack capacity or resources when needed.

Answer

Long RTO due to data transfer

Answer

High cost of maintaining duplicate infrastructure

Answer

Incompatible hardware

Question 12

An organization's backup schedule: Full backup every Sunday, incremental backups Monday-Saturday. If a failure occurs on Thursday, how many backup sets are needed to restore the data?

Accepted Answer

4 (Sunday full and Monday, Tuesday, Wednesday incrementals). For incremental backups, you need the last full backup and all incrementals since then. So Sunday full + Monday, Tuesday, Wednesday incrementals (4 sets).

Answer

5 (Sunday full and all incrementals through Thursday)

Answer

1 (Sunday full only)

Answer

2 (Sunday full and Wednesday incremental)

Question 13

Which phase of the incident response process involves restoring systems to normal operations and confirming they are functioning correctly?

Accepted Answer

Recovery. Recovery is the phase after eradication where systems are restored and tested.

Answer

Detection

Answer

Containment

Answer

Eradication

Question 14

A security analyst is prioritizing incidents based on severity. Which TWO factors are most important for determining incident severity?

Accepted Answer

Sensitivity of the data potentially compromised. Severity is based on impact (e.g., data sensitivity, criticality) and scope (affected users/systems).

Answer

Type of operating system involved

Answer

Time of day the incident occurred

Answer

Color of the server room

Question 15

After a major power outage, an organization needs to declare a disaster and activate its DRP. Which THREE elements should be included in the initial crisis communication?

Accepted Answer

A statement that a disaster has been declared. Initial communication should confirm the disaster, provide initial instructions, and outline next steps without revealing sensitive details.

Answer

Details of the vulnerability exploited

Answer

Names of affected customers