ISC2 CC Business Continuity, Disaster Recovery, and Incident Response Practice Test 5 — 15 Questions

Question 1

An organization is creating a Business Continuity Plan (BCP). Which analysis should be performed first to identify critical business functions and their dependencies?

Accepted Answer

Business Impact Analysis. A Business Impact Analysis (BIA) is the first step in BCP to identify critical functions, dependencies, and recovery priorities.

Answer

Risk Assessment

Answer

Vulnerability Assessment

Answer

Gap Analysis

Question 2

A company's critical database must be recovered within 4 hours after a disaster, and they can tolerate losing up to 1 hour of data. During a disaster, after the systems are restored, it takes an additional 30 minutes to verify data integrity and resume normal operations. Which metric is represented by the 4-hour requirement?

Accepted Answer

Recovery Time Objective (RTO). Recovery Time Objective (RTO) is the maximum acceptable time to restore systems and data after a disaster.

Answer

Maximum Tolerable Downtime (MTD)

Answer

Recovery Point Objective (RPO)

Answer

Work Recovery Time (WRT)

Question 3

A financial institution requires near-instantaneous recovery of its trading platform after a disaster. The recovery time objective (RTO) is 2 hours, and the recovery point objective (RPO) is 15 minutes. Which recovery site strategy best meets these requirements?

Accepted Answer

Hot site. A hot site mirrors the production environment continuously, allowing recovery within hours and minimal data loss.

Answer

Reciprocal agreement

Answer

Warm site

Answer

Cold site

Question 4

During a disaster recovery test, the IT team discovers that restoring all data from full backups takes 48 hours, exceeding the RTO. Which backup strategy would reduce restore time while maintaining a similar backup window?

Accepted Answer

Using differential backups instead of incremental. A differential backup backs up all changes since the last full backup, so restore requires only the full backup and the latest differential, reducing restore time compared to incremental.

Answer

Increasing backup frequency to hourly

Answer

Implementing the 3-2-1 backup rule

Answer

Switching from full to incremental backups only

Question 5

Which backup method copies all data that has changed since the last full backup, regardless of subsequent incremental or differential backups?

Accepted Answer

Differential backup. A differential backup copies all changes since the last full backup, making it distinct from incremental which copies changes since the last backup of any type.

Answer

Full backup

Answer

Synthetic full backup

Answer

Incremental backup

Question 6

A hospital's electronic health record (EHR) system must be available 24/7. The disaster recovery plan specifies an RTO of 4 hours and an RPO of 1 hour. Which combination of backup and site strategy best meets these objectives?

Accepted Answer

Hot site with continuous data replication. A warm site with hourly incremental backups can achieve RTO of days? Actually, warm site RTO is typically days, so more suitable is hot site. But given options, warm site plus differential may be plausible? Better: hot site with frequent backups. However, the correct answer should be hot site with continuous replication to meet RPO of 1 hour and RTO of 4 hours.

Answer

Cloud-based recovery with daily snapshots

Answer

Warm site with weekly full backups

Answer

Cold site with daily full backups

Question 7

An organization uses a 3-2-1 backup strategy. They have a primary full backup on a local NAS, a second copy on tape stored offsite, and a third copy in the cloud. During a ransomware attack, the local NAS and the tape library are both encrypted. Which copy should be used for recovery?

Accepted Answer

The cloud backup. The 3-2-1 rule ensures one copy is offsite and isolated. The cloud copy is likely immutable or separate, so it can be used for recovery.

Answer

The tape backup

Answer

The local NAS backup

Answer

A new full backup from production data

Question 8

Which phase of the incident response process involves actions to stop the incident from causing further damage, such as isolating affected systems?

Accepted Answer

Containment. Containment is the phase where actions are taken to limit the scope and impact of the incident.

Answer

Eradication

Answer

Analysis

Answer

Detection

Question 9

A security analyst detects unusual outbound network traffic from a server that normally does not communicate externally. After confirming a malware infection, the analyst isolates the server from the network. Which incident response phase is the analyst performing?

Accepted Answer

Containment. Isolating the server is a containment action to prevent spread.

Answer

Recovery

Answer

Detection

Answer

Eradication

Question 10

During a data breach investigation, the incident response team discovers that personally identifiable information (PII) of EU residents was exfiltrated. Under GDPR, what is the maximum time frame for notifying the supervisory authority?

Accepted Answer

72 hours. GDPR requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach.

Answer

7 days

Answer

48 hours

Answer

24 hours

Question 11

Which type of incident involves an attacker attempting to make a system or network resource unavailable to legitimate users?

Accepted Answer

Denial of service. A denial of service (DoS) attack aims to disrupt services by overwhelming resources.

Answer

Social engineering

Answer

Malware

Answer

Data breach

Question 12

After an incident is resolved, which phase involves reviewing what happened, documenting lessons learned, and updating procedures?

Accepted Answer

Lessons learned. The lessons learned phase captures improvements for future incidents.

Answer

Eradication

Answer

Containment

Answer

Recovery

Question 13

A company is selecting a recovery site strategy. Which TWO factors should be considered when choosing between a hot site and a warm site? (Select TWO.)

Accepted Answer

Cost. RTO and cost are primary differentiators: hot sites have shorter RTO but higher cost.

Answer

Number of employees

Answer

Color of the server racks

Answer

Type of operating system

Question 14

An organization is updating its incident response plan. Which THREE elements should be included in the preparation phase? (Select THREE.)

Accepted Answer

Conducting tabletop exercises. Preparation includes establishing tools, training staff, and developing the plan.

Answer

Restoring data from backups

Answer

Notifying law enforcement

Question 15

During a ransomware incident, the incident response team needs to communicate with stakeholders. According to best practices, which TWO groups should be notified immediately? (Select TWO.)

Accepted Answer

Legal and public relations. Internal management and legal/PR need to be informed early to coordinate response and manage communications.

Answer

Affected customers

Answer

All employees

Answer

Competitors