ISC2 CC Business Continuity, Disaster Recovery, and Incident Response Practice Test 5 — 15 Questions

Question 1

A company uses a backup strategy where on Monday a full backup is taken, and on Tuesday only data changed since Monday is backed up. On Wednesday, the backup includes all data changed since Monday. What type of backup is the Wednesday backup?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Differential backup. A differential backup captures all data changed since the last full backup, regardless of how many incremental or differential backups have occurred since. Since Monday's full backup is the baseline and Wednesday's backup includes everything changed since Monday, it is a differential backup. It does not reset the baseline, so Thursday's differential would also include Tuesday's and Wednesday's changes.

Answer

Incremental backup

Answer

Synthetic full backup

Answer

Full backup

Question 2

During an incident, the incident response team identifies that a malware infection is spreading. They isolate affected systems to prevent further damage. Which phase of the incident response process are they performing?

Accepted Answer

Containment. Containment is the incident response phase focused on limiting the scope and impact of an incident by stopping the spread of malware and preventing further damage. Isolating affected systems directly aligns with this goal, as it prevents lateral movement and additional infections. This phase occurs after detection and before eradication and recovery.

Answer

Recovery

Answer

Eradication

Answer

Detection

Question 3

A security analyst detects unusual outbound traffic from a server that suggests a data breach. According to GDPR, within what timeframe must the organization notify the supervisory authority?

Accepted Answer

72 hours. GDPR mandates notification within 72 hours of awareness of a breach.

Answer

48 hours

Answer

7 days

Answer

24 hours

Question 4

An organization is adopting the 3-2-1 backup rule. They currently have data on a primary server and a daily backup to an external hard drive. To comply with the rule, what is the minimum additional requirement?

Accepted Answer

A cloud backup stored offsite. The 3-2-1 backup rule requires at least three copies of data, on two different media types, with one copy stored offsite. The organization currently has two copies (primary and external hard drive), both likely on-site and possibly the same media type. Adding a cloud backup provides the required third copy and satisfies the offsite requirement, making it the minimum additional requirement.

Answer

A second external hard drive stored on-site

Answer

An incremental backup to a network share

Answer

A full backup on tape stored in the same room

Question 5

Which incident category involves an attacker tricking an employee into revealing credentials?

Accepted Answer

Social engineering. Social engineering is the incident category that involves manipulating people into divulging confidential information, such as credentials. Attackers use psychological tactics like phishing, pretexting, or baiting to trick employees into revealing passwords or other sensitive data.

Answer

Data breach

Answer

Malware

Answer

Denial of service

Question 6

During a disaster, an organization activates a reciprocal agreement with another company. What is a primary risk associated with this strategy?

Accepted Answer

Potential lack of capacity when both parties need resources simultaneously. A reciprocal agreement (also called a mutual aid pact) is a disaster recovery arrangement where two organizations agree to share each other's computing facilities in an emergency. The primary risk is that a disaster may affect both parties simultaneously—such as a regional event like a hurricane, earthquake, or widespread power outage—leaving neither with spare capacity to host the other's workloads. Because neither party maintains dedicated redundant resources for the other, resource contention during a shared crisis is the defining weakness of this strategy.

Answer

Long RTO due to data transfer

Answer

High cost of maintaining duplicate infrastructure

Answer

Incompatible hardware

Question 7

Which phase of the incident response process involves restoring systems to normal operations and confirming they are functioning correctly?

Accepted Answer

Recovery. Recovery is the phase after eradication where systems are restored and tested.

Answer

Detection

Answer

Containment

Answer

Eradication

Question 8

A security analyst is prioritizing incidents based on severity. Which TWO factors are most important for determining incident severity?

Accepted Answer

Sensitivity of the data potentially compromised. Option A is correct because the sensitivity of the data potentially compromised directly drives severity: exposure of regulated or high-classification data (e.g., PII, PHI, cardholder data under PCI DSS, or trade secrets) raises the potential impact and therefore the incident's severity rating. Option C is correct because the number of users affected measures the scope and blast radius of the incident, and broader impact across more accounts or systems generally elevates severity. The type of operating system involved (B) is not a primary severity factor, since impact depends on the affected assets and data rather than the OS platform itself. The time of day the incident occurred (D) is contextual and may influence response logistics but not the intrinsic severity. The color of the server room (E) is irrelevant to incident severity.

Answer

Type of operating system involved

Answer

Time of day the incident occurred

Answer

Color of the server room

Question 9

After a major power outage, an organization needs to declare a disaster and activate its DRP. Which THREE elements should be included in the initial crisis communication?

Accepted Answer

A statement that a disaster has been declared. Option A is correct because the initial crisis communication must explicitly state that a disaster has been declared, which formally triggers the DRP and informs stakeholders that recovery procedures are now in effect. Option C is correct because providing contact information for the incident response team ensures that responders and key personnel can be reached immediately to coordinate recovery activities. Option D is correct because instructing employees to work remotely helps maintain business continuity and safety by directing staff away from potentially affected facilities. Option B is not included because details of the exploited vulnerability are typically investigated and disclosed later by security or forensic teams, not in the initial crisis notification. Option E is also not included because naming affected customers raises privacy and legal concerns and is not part of the immediate internal crisis communication.

Answer

Details of the vulnerability exploited

Answer

Names of affected customers

Question 10

An organization is creating a Business Continuity Plan (BCP). Which analysis should be performed first to identify critical business functions and their dependencies?

Accepted Answer

Business Impact Analysis. The Business Impact Analysis (BIA) is the foundational step in BCP development because it systematically identifies critical business functions, their dependencies, and the impact of their disruption over time. It quantifies the consequences of downtime, helping prioritize recovery objectives like RTO and RPO. Without a BIA, subsequent risk assessment and recovery strategies lack a business-driven focus.

Answer

Risk Assessment

Answer

Vulnerability Assessment

Answer

Gap Analysis

Question 11

A financial institution requires near-instantaneous recovery of its trading platform after a disaster. The recovery time objective (RTO) is 2 hours, and the recovery point objective (RPO) is 15 minutes. Which recovery site strategy best meets these requirements?

Accepted Answer

Hot site. A hot site is a fully operational duplicate of the primary data center with real-time or near-real-time data replication, allowing recovery within minutes. It is the only strategy that can meet an RTO of 2 hours and an RPO of 15 minutes for a trading platform. Hot sites are expensive but necessary for near-instantaneous recovery.

Answer

Reciprocal agreement

Answer

Warm site

Answer

Cold site

Question 12

Which backup method copies all data that has changed since the last full backup, regardless of subsequent incremental or differential backups?

Accepted Answer

Differential backup. A differential backup captures all data changed since the last full backup, so each successive differential grows larger until the next full backup resets the baseline. This differs from an incremental backup, which only captures changes since the last backup of any type. The key characteristic in the question — 'regardless of subsequent incremental or differential backups' — matches the differential model, where the reference point remains the last full backup.

Answer

Full backup

Answer

Synthetic full backup

Answer

Incremental backup

Question 13

A hospital's electronic health record (EHR) system must be available 24/7. The disaster recovery plan specifies an RTO of 4 hours and an RPO of 1 hour. Which combination of backup and site strategy best meets these objectives?

Accepted Answer

Hot site with continuous data replication. A hot site with continuous data replication best meets an RTO of 4 hours and RPO of 1 hour because a hot site is a fully operational duplicate facility that can take over almost immediately, and continuous replication keeps data loss well under 1 hour. This combination provides the lowest recovery time and data loss, aligning with the hospital's 24/7 availability requirement.

Answer

Cloud-based recovery with daily snapshots

Answer

Warm site with weekly full backups

Answer

Cold site with daily full backups

Question 14

An organization uses a 3-2-1 backup strategy. They have a primary full backup on a local NAS, a second copy on tape stored offsite, and a third copy in the cloud. During a ransomware attack, the local NAS and the tape library are both encrypted. Which copy should be used for recovery?

Accepted Answer

The cloud backup. The cloud backup is the only copy that was not compromised by the ransomware attack, since both the local NAS and the offsite tape library were encrypted. In a 3-2-1 strategy, the offsite copy is specifically intended to survive local disasters, but here the attacker reached both on-premises copies. The cloud copy, being isolated and typically immutable or versioned, is the correct recovery source.

Answer

The tape backup

Answer

The local NAS backup

Answer

A new full backup from production data

Question 15

Which phase of the incident response process involves actions to stop the incident from causing further damage, such as isolating affected systems?

Accepted Answer

Containment. Containment is the incident response phase focused on limiting the scope and impact of an incident — isolating affected systems, disabling compromised accounts, and blocking malicious traffic to prevent further damage. It occurs after detection and analysis but before eradication and recovery. The goal is to stop the spread while preserving evidence for investigation.

Answer

Eradication

Answer

Analysis

Answer

Detection