ISC2 CC Business Continuity, Disaster Recovery, and Incident Response Practice Test 6 — 15 Questions

Question 1

During a ransomware incident, the incident response team needs to communicate with stakeholders. According to best practices, which TWO groups should be notified immediately? (Select TWO.)

Accepted Answer

Legal and public relations. Internal management and legal/PR need to be informed early to coordinate response and manage communications.

Answer

Affected customers

Answer

All employees

Answer

Competitors

Question 2

An organization wants to ensure that its critical business functions can continue operating during a disruption. Which plan specifically addresses keeping the business running during a disruption?

Accepted Answer

Business Continuity Plan (BCP). The Business Continuity Plan (BCP) focuses on maintaining business operations during a disruption, while the Disaster Recovery Plan (DRP) focuses on restoring IT systems after a disruption.

Answer

Incident Response Plan (IRP)

Answer

Disaster Recovery Plan (DRP)

Answer

Business Impact Analysis (BIA)

Question 3

A company's Business Impact Analysis (BIA) determines that its online payment system can tolerate a maximum of 2 hours of downtime. The IT team estimates that restoring the system from backups will take 1 hour, and the team needs another 30 minutes to verify data integrity and resume normal operations. Which metric does the 30-minute verification period represent?

Accepted Answer

Work Recovery Time (WRT). Work Recovery Time (WRT) is the time needed after systems are restored to return to normal operations, distinct from RTO which is the time to restore functionality.

Answer

Recovery Point Objective (RPO)

Answer

Maximum Tolerable Downtime (MTD)

Answer

Recovery Time Objective (RTO)

Question 4

An organization is selecting a recovery site strategy that offers the fastest recovery time, measured in hours, to minimize downtime for critical applications. Which recovery site type best meets this requirement?

Accepted Answer

Hot site. The hot site is the best choice for the fastest recovery time, as it is fully equipped and operational with real-time data replication, allowing recovery within hours. In contrast, a warm site requires activation and data restoration, typically taking days, while a cold site needs hardware and software installation, taking weeks. Cloud-based recovery can be fast but may involve data retrieval and configuration delays, making it slower than a hot site for critical applications.

Answer

Cloud-based recovery

Answer

Cold site

Answer

Warm site

Question 5

A company performs a full backup every Sunday and incremental backups on other days. On Wednesday, a server failure occurs. Which backups are needed to restore the server to its state at Tuesday's backup?

Accepted Answer

Sunday full backup, Monday incremental, and Tuesday incremental. With incremental backups, you need the last full backup and all subsequent incremental backups up to the point of failure. Here, Sunday full + Monday incremental + Tuesday incremental.

Answer

Only Tuesday incremental backup

Answer

Only the Sunday full backup

Answer

Sunday full backup and Monday incremental backup

Question 6

During an incident, a security analyst detects unusual network traffic from a workstation that is exfiltrating data to an external IP address. The analyst isolates the workstation. Which incident response phase does the isolation action belong to?

Accepted Answer

Containment. Containment is the phase where actions are taken to stop the incident from spreading or causing further damage, such as isolating affected systems.

Answer

Detection

Answer

Analysis

Answer

Eradication

Question 7

Which backup strategy requires the least amount of time to perform a daily backup but the most time to perform a full restore?

Accepted Answer

Incremental backup. Incremental backups only back up changes since the last backup (any type), making them fastest to perform but slowest to restore because all increments since the last full must be applied.

Answer

Differential backup

Answer

Full backup

Answer

Synthetic full backup

Question 8

A healthcare organization experiences a data breach involving protected health information (PHI). Under GDPR, within how many hours must the organization notify the relevant supervisory authority?

Accepted Answer

72 hours. GDPR requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach.

Answer

24 hours

Answer

48 hours

Answer

7 days

Question 9

An organization has an RTO of 4 hours and an RPO of 1 hour for its customer database. After a disaster, the IT team restores the database from backups that are 2 hours old, and the system becomes operational in 3 hours. Which of the following is true?

Accepted Answer

The RTO was met, but the RPO was not.. The system was restored in 3 hours, which is within the 4-hour RTO. However, data loss is 2 hours, exceeding the 1-hour RPO.

Answer

Neither the RTO nor RPO was met.

Answer

The RPO was met, but the RTO was not.

Answer

Both the RTO and RPO were met.

Question 10

Which phase of the incident response process involves restoring systems to normal operation and applying patches to prevent recurrence?

Accepted Answer

Recovery. Eradication removes the cause, and recovery restores systems. The question describes both eradication (patches) and recovery (restore), but 'recovery' is the phase where normal operations resume after eradication.

Answer

Containment

Answer

Eradication

Answer

Detection

Question 11

Which of the following is a key component of the 3-2-1 backup rule?

Accepted Answer

Three copies, two different media types, one off-site. The 3-2-1 rule states: have 3 copies of data, on 2 different media types, with 1 copy off-site.

Answer

Two copies on different media, one off-site

Answer

One copy on two different media, two off-site

Answer

Three copies on different media, two off-site

Question 12

A company has a reciprocal agreement with another organization for disaster recovery. During a major outage, the company attempts to activate the agreement but finds that the partner's facility is also impacted by the same disaster. This scenario highlights a primary disadvantage of which recovery strategy?

Accepted Answer

Reciprocal agreement. Reciprocal agreements depend on the partner not being affected by the same disaster. If both are impacted, the agreement fails.

Answer

Cold site

Answer

Warm site

Answer

Hot site

Question 13

During a security incident, a company must notify stakeholders without revealing sensitive details that could worsen the situation. Which TWO groups should typically be notified immediately according to incident response best practices? (Select TWO)

Accepted Answer

Legal department. Legal must be notified for regulatory and liability issues, and management/executives for decision-making and resource allocation. Customers and PR may be notified later, and law enforcement depends on the incident.

Answer

All affected customers immediately

Answer

General public via press release

Answer

Local law enforcement automatically

Question 14

An organization is implementing backup strategies. Which THREE are characteristics of differential backups? (Select THREE)

Accepted Answer

Requires only the last full backup and the latest differential backup for a full restore. Differential backups copy all changes since the last full backup, making them medium-sized and faster to restore than incremental, but slower to back up than incremental.

Answer

Backup time is generally faster than incremental backups

Answer

Requires all differential backups since the last full backup for a full restore

Question 15

An incident response team is analyzing a data breach. Which THREE actions are part of the 'Lessons Learned' phase? (Select THREE)

Accepted Answer

Documenting the timeline of events and actions taken. Lessons Learned involves reviewing the incident, updating plans, and conducting post-mortems to improve future response. Identifying the root cause is part of analysis/eradication.

Answer

Identifying the root cause of the breach

Answer

Isolating affected systems to prevent further damage