ISC2 CC Business Continuity, Disaster Recovery, and Incident Response Practice Test 6 — 15 Questions

Question 1

A security analyst detects unusual outbound network traffic from a server that normally does not communicate externally. After confirming a malware infection, the analyst isolates the server from the network. Which incident response phase is the analyst performing?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Containment. Isolating the server is a containment action to prevent spread.

Answer

Recovery

Answer

Detection

Answer

Eradication

Question 2

During a data breach investigation, the incident response team discovers that personally identifiable information (PII) of EU residents was exfiltrated. Under GDPR, what is the maximum time frame for notifying the supervisory authority?

Accepted Answer

72 hours. GDPR requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach.

Answer

7 days

Answer

48 hours

Answer

24 hours

Question 3

Which type of incident involves an attacker attempting to make a system or network resource unavailable to legitimate users?

Accepted Answer

Denial of service. A Denial of Service (DoS) attack explicitly aims to disrupt the availability of a system or network resource, making it inaccessible to legitimate users. This aligns with the definition of a DoS incident, which focuses on overwhelming the target with traffic or exploiting vulnerabilities to exhaust resources. The other options describe different attack categories: social engineering targets human trust, malware is malicious software, and data breach involves unauthorized data access.

Answer

Social engineering

Answer

Malware

Answer

Data breach

Question 4

After an incident is resolved, which phase involves reviewing what happened, documenting lessons learned, and updating procedures?

Accepted Answer

Lessons learned. The Lessons Learned phase occurs after an incident is resolved and focuses on reviewing the response, documenting what happened, and updating procedures to prevent recurrence. It is a post-incident activity, distinct from the active response phases. Containment, eradication, and recovery all happen during the incident lifecycle before lessons learned.

Answer

Eradication

Answer

Containment

Answer

Recovery

Question 5

An organization is updating its incident response plan. Which THREE elements should be included in the preparation phase? (Select THREE.)

Accepted Answer

Conducting tabletop exercises. Option C (Conducting tabletop exercises) is correct because tabletop exercises are a preparation-phase activity that validates and rehearses the incident response plan, roles, and communication paths before a real incident occurs. Option D (Acquiring forensic analysis tools) is correct because procuring and maintaining forensic toolkits (e.g., disk imaging, memory capture, and analysis utilities) is part of building the resources and capabilities needed during preparation. Option E (Creating an incident response team) is correct because establishing the CSIRT/IR team, defining its roles, and assigning responsibilities is a foundational preparation-phase element. Option A (Restoring data from backups) belongs to the recovery/eradication-and-recovery phase, since restoration happens after containment and eradication, not during preparation. Option B (Notifying law enforcement) is a coordination/communication action taken during or after detection and response, not a preparation-phase element.

Answer

Restoring data from backups

Answer

Notifying law enforcement

Question 6

During a ransomware incident, the incident response team needs to communicate with stakeholders. According to best practices, which TWO groups should be notified immediately? (Select TWO.)

Accepted Answer

Legal and public relations. Option B (Legal and public relations) is correct because during a ransomware incident, legal counsel must be engaged immediately to assess regulatory notification obligations (e.g., GDPR, HIPAA, SEC disclosure rules) and preserve attorney-client privilege, while public relations manages external messaging to protect the organization's reputation and prevent misinformation. Option E (Internal management) is correct because executive leadership and management must be notified right away to authorize incident response actions, allocate resources, make critical business decisions, and fulfill their governance and oversight responsibilities. Option A (Affected customers) is not an immediate notification group; customer notification typically occurs after the scope of the breach is determined and legal/regulatory guidance is obtained, often with a defined timeline. Option C (All employees) is too broad for immediate notification, as mass communication can cause panic or leaks; only those with a need to know are informed initially. Option D (Competitors) has no legitimate role in incident response notification and would only expose the organization to further risk.

Answer

Affected customers

Answer

All employees

Answer

Competitors

Question 7

An organization wants to ensure that its critical business functions can continue operating during a disruption. Which plan specifically addresses keeping the business running during a disruption?

Accepted Answer

Business Continuity Plan (BCP). The Business Continuity Plan (BCP) is specifically designed to ensure that critical business functions continue operating during and after a disruption. It encompasses strategies for maintaining operations, while DRP focuses on recovering IT infrastructure. Thus, BCP is the correct answer.

Answer

Incident Response Plan (IRP)

Answer

Disaster Recovery Plan (DRP)

Answer

Business Impact Analysis (BIA)

Question 8

A company's Business Impact Analysis (BIA) determines that its online payment system can tolerate a maximum of 2 hours of downtime. The IT team estimates that restoring the system from backups will take 1 hour, and the team needs another 30 minutes to verify data integrity and resume normal operations. Which metric does the 30-minute verification period represent?

Accepted Answer

Work Recovery Time (WRT). The 30-minute verification period represents Work Recovery Time (WRT), which is the time needed after systems are technically restored to validate data integrity and confirm normal operations can resume. WRT is distinct from RTO because RTO covers only the time to bring systems back online, while WRT accounts for the post-recovery validation phase. Together, RTO + WRT must fit within the Maximum Tolerable Downtime (MTD) of 2 hours, which in this case is satisfied (1 hour RTO + 30 min WRT = 1.5 hours).

Answer

Recovery Point Objective (RPO)

Answer

Maximum Tolerable Downtime (MTD)

Answer

Recovery Time Objective (RTO)

Question 9

An organization is selecting a recovery site strategy that offers the fastest recovery time, measured in hours, to minimize downtime for critical applications. Which recovery site type best meets this requirement?

Accepted Answer

Hot site. A hot site is a fully equipped alternate facility that is ready to operate immediately, offering the fastest recovery time, often within hours. It mirrors the primary site's hardware, software, and data, allowing critical applications to resume quickly. Thus, D is correct.

Answer

Cloud-based recovery

Answer

Cold site

Answer

Warm site

Question 10

A company performs a full backup every Sunday and incremental backups on other days. On Wednesday, a server failure occurs. Which backups are needed to restore the server to its state at Tuesday's backup?

Accepted Answer

Sunday full backup, Monday incremental, and Tuesday incremental. With a weekly full backup on Sunday and daily incrementals, each incremental captures only changes since the last backup. To restore to Tuesday's state you must apply the Sunday full backup first, then Monday's incremental, then Tuesday's incremental in sequence. Incrementals cannot be applied standalone because they depend on the previous backup chain.

Answer

Only Tuesday incremental backup

Answer

Only the Sunday full backup

Answer

Sunday full backup and Monday incremental backup

Question 11

During an incident, a security analyst detects unusual network traffic from a workstation that is exfiltrating data to an external IP address. The analyst isolates the workstation. Which incident response phase does the isolation action belong to?

Accepted Answer

Containment. Isolation of an affected workstation is a containment action because it stops the spread of the incident and prevents further data exfiltration while the investigation continues. Containment is the phase in the NIST/SANS incident response lifecycle (Preparation, Detection & Analysis, Containment, Eradication, Recovery, Post-Incident) where the goal is to limit damage and prevent the incident from expanding. Detection and analysis involve identifying and validating the event; eradication removes the root cause.

Answer

Detection

Answer

Analysis

Answer

Eradication

Question 12

Which backup strategy requires the least amount of time to perform a daily backup but the most time to perform a full restore?

Accepted Answer

Incremental backup. An incremental backup only captures data changed since the last backup of any type, so each daily run is very fast and small. However, a full restore requires the last full backup plus every incremental since then, applied in sequence—making restore the slowest of all strategies.

Answer

Differential backup

Answer

Full backup

Answer

Synthetic full backup

Question 13

A healthcare organization experiences a data breach involving protected health information (PHI). Under GDPR, within how many hours must the organization notify the relevant supervisory authority?

Accepted Answer

72 hours. Under GDPR Article 33, a controller must notify the relevant supervisory authority of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to data subjects' rights and freedoms. PHI constitutes personal data under GDPR, so the 72-hour clock applies. This deadline is a maximum; notification should occur as soon as possible within that window.

Answer

24 hours

Answer

48 hours

Answer

7 days

Question 14

An organization has an RTO of 4 hours and an RPO of 1 hour for its customer database. After a disaster, the IT team restores the database from backups that are 2 hours old, and the system becomes operational in 3 hours. Which of the following is true?

Accepted Answer

The RTO was met, but the RPO was not.. The RTO of 4 hours was met because the system became operational in 3 hours, which is within the 4-hour target. However, the RPO of 1 hour was not met because the restored data was 2 hours old, meaning up to 2 hours of data was lost, exceeding the 1-hour maximum tolerable data loss. Therefore, the RTO was met but the RPO was not.

Answer

Neither the RTO nor RPO was met.

Answer

The RPO was met, but the RTO was not.

Answer

Both the RTO and RPO were met.

Question 15

Which phase of the incident response process involves restoring systems to normal operation and applying patches to prevent recurrence?

Accepted Answer

Recovery. The Recovery phase of the incident response process is specifically focused on restoring systems to normal operation after the incident has been contained and eradicated. This includes applying patches, reconfiguring systems, and validating that the environment is secure before returning to production. According to NIST SP 800-61, Recovery involves restoring systems, implementing safeguards against similar incidents, and testing to ensure functionality. Thus, Recovery is the correct answer.

Answer

Containment

Answer

Eradication

Answer

Detection