ISC2 CC Business Continuity, Disaster Recovery, and Incident Response Practice Test 7 — 15 Questions

Question 1

Which of the following is a key component of the 3-2-1 backup rule?

Accepted Answer

Three copies, two different media types, one off-site. The 3-2-1 backup rule specifies three copies of data (one primary plus two backups), stored on two different media types, with one copy kept off-site. Option D captures all three elements precisely, which is why it is the canonical definition used in CompTIA and vendor backup guidance.

Answer

Two copies on different media, one off-site

Answer

One copy on two different media, two off-site

Answer

Three copies on different media, two off-site

Question 2

A company has a reciprocal agreement with another organization for disaster recovery. During a major outage, the company attempts to activate the agreement but finds that the partner's facility is also impacted by the same disaster. This scenario highlights a primary disadvantage of which recovery strategy?

Accepted Answer

Reciprocal agreement. A reciprocal agreement is a DR arrangement where two organizations agree to host each other's workloads during a disaster, typically at no or low cost. The scenario shows the classic failure mode: a regional disaster affects both parties simultaneously, so the partner site is unavailable exactly when it is needed.

Answer

Cold site

Answer

Warm site

Answer

Hot site

Question 3

During a security incident, a company must notify stakeholders without revealing sensitive details that could worsen the situation. Which TWO groups should typically be notified immediately according to incident response best practices? (Select TWO)

Accepted Answer

Legal department. Option C (Legal department) is correct because incident response best practices require immediate legal counsel involvement to assess regulatory notification obligations (e.g., GDPR 72-hour breach reporting, HIPAA, SEC disclosure rules), preserve attorney-client privilege over incident findings, and guide controlled communications that avoid premature or legally risky disclosures. Option D (Executive management) is correct because senior leadership must be notified immediately to authorize containment actions, allocate resources, make strategic decisions about service shutdowns or customer impact, and serve as the approved channel for any external statements. Option A is not correct because notifying all affected customers immediately is premature before the scope, root cause, and legal notification requirements are established, and it risks amplifying the incident. Option B is not correct because issuing a general public press release at the outset can worsen the situation by revealing sensitive details and tipping off attackers. Option E is not correct because law enforcement should be engaged selectively based on jurisdiction, legal guidance, and incident severity, not automatically in every case.

Answer

All affected customers immediately

Answer

General public via press release

Answer

Local law enforcement automatically

Question 4

A company is planning its backup strategy and wants to balance storage efficiency with restore speed. Which TWO backup strategies should the company consider? (Select TWO)

Accepted Answer

Full backup weekly, incremental daily. To minimize storage usage while ensuring fast restores, a common strategy is to use a full backup as the primary and either incremental or differential as the secondary. Option A (full weekly + incremental daily) saves storage as incremental backups only store changes since the last backup, but restore requires the full and all incrementals. Option C (full weekly + differential daily) uses more storage than incremental but restore is faster as only the full and last differential are needed. Both strategies meet the requirements; other options either use excessive storage (B, E) or slow restore (D) or are not two-type strategies.

Answer

Full backup daily, no other backups

Answer

Full backup monthly, incremental weekly

Answer

Full backup weekly, incremental daily, and differential weekly

Question 5

A financial services company is conducting a Business Impact Analysis (BIA) for its online banking platform. Which THREE of the following are correctly defined metrics used in BIA?

Accepted Answer

Recovery Time Objective (RTO) – the maximum amount of time to restore a business function after a disruption.. Option B is correct because the Recovery Time Objective (RTO) is a core BIA metric defining the maximum acceptable time to restore a business function or process after a disruption before unacceptable consequences occur. Option C is correct because the Maximum Tolerable Downtime (MTD), also called Maximum Acceptable Outage (MAO), defines the total time a business function can be unavailable before causing irreparable harm to the organization, and it typically bounds the RTO. Option E is correct because the Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss measured in time, determining the required backup or replication frequency. Option A is not a BIA metric but a contractual service commitment, and Option D is a risk-analysis quantitative value (SLE × ARO) rather than a BIA recovery metric.

Answer

Service Level Agreement (SLA) – the contractual uptime percentage guaranteed to customers.

Answer

Annualized Loss Expectancy (ALE) – the expected monetary loss per year from a risk.

Question 6

An organization experiences a data breach involving personally identifiable information (PII) of European Union residents. According to GDPR, which THREE of the following are required actions?

Accepted Answer

Document the breach, its effects, and the remedial actions taken.. Option A is correct because GDPR Article 33(5) requires the controller to document all personal data breaches, including the facts, effects, and remedial actions taken, so the supervisory authority can verify compliance. Option C is correct because GDPR Articles 33(1) and 34(1) require communication to affected data subjects without undue delay when the breach is likely to result in a high risk to their rights and freedoms. Option E is correct because GDPR Article 33(1) mandates notifying the relevant supervisory authority within 72 hours of becoming aware of the breach, unless it is unlikely to result in a risk. Option B is not a GDPR requirement; restoring from backup is a general recovery practice, not a breach-notification obligation. Option D is not required by GDPR; a BIA is a business continuity tool, whereas GDPR requires a Data Protection Impact Assessment (DPIA) in certain cases, not a BIA for breach response.

Answer

Restore all affected systems from the latest full backup.

Answer

Conduct a Business Impact Analysis (BIA) to determine the financial impact.

Question 7

A mid-sized hospital's disaster recovery team is reviewing its incident response plan after a ransomware attack encrypted the electronic health record (EHR) system. The team determines that the attack began 36 hours before it was detected. Which incident response phase was most directly compromised by this delay?

Accepted Answer

Detection and Analysis. The 36-hour gap between the onset of the ransomware attack and its discovery points directly to a failure in the Detection and Analysis phase, where monitoring and alerting should identify malicious activity quickly. While preparation, containment, and post-incident review all matter, the scenario describes a delay in recognizing the incident, which is the defining activity of detection and analysis. Improving detection capabilities would most directly address this gap.

Answer

Preparation

Answer

Post-Incident Activity

Answer

Containment, Eradication, and Recovery

Question 8

A regional hospital's emergency department relies on a patient tracking system. The BIA shows the system's maximum tolerable downtime (MTD) is 2 hours. The recovery time objective (RTO) is currently 6 hours, and the recovery point objective (RPO) is 24 hours. Which action best aligns the recovery capability with the business requirement?

Accepted Answer

Reduce the RTO to 2 hours or less and reduce the RPO to a level that meets clinical data loss tolerance.. The MTD is the maximum time a business process can be unavailable. For the patient tracking system, the MTD is 2 hours. The RTO, which is the target time to restore the system, must be less than or equal to the MTD. The current RTO of 6 hours exceeds the MTD, so it must be reduced. The RPO must also be evaluated to ensure data loss is acceptable. Reducing the RTO and reassessing the RPO ensures recovery aligns with the business requirement.

Answer

Increase the MTD to 6 hours so it matches the existing RTO.

Answer

Implement a hot site that can recover the system within 24 hours, matching the RPO.

Answer

Maintain the current RTO and RPO because the MTD is only a guideline and not a strict requirement.

Question 9

A financial services firm has a recovery time objective (RTO) of 2 hours for its trading platform and a recovery point objective (RPO) of 15 minutes. The disaster recovery team is evaluating whether a warm site can meet these requirements. Which statement best describes the limitation of a warm site in this scenario?

Accepted Answer

A warm site cannot meet the RTO because it requires manual data restoration and configuration, which typically takes longer than 2 hours.. A warm site provides pre-installed hardware and network connectivity but requires data restoration and system configuration before it can operate. For a trading platform with a 2-hour RTO, this manual effort typically exceeds the acceptable outage window. While the 15-minute RPO could be addressed with replication, the RTO is the binding constraint that makes a warm site a poor fit without substantial automation.

Answer

A warm site cannot meet the RPO because it does not support data replication from the primary site.

Answer

A warm site can meet the RTO because it only requires switching network routes to the standby environment.

Answer

A warm site is identical to a hot site and can meet both the RTO and RPO without any additional configuration.

Question 10

A financial services firm has activated its disaster recovery plan after a ransomware attack encrypted its primary data center. The incident response team has contained the attack, but the recovery team must restore operations. Which action should the recovery team take FIRST to ensure a successful restoration?

Accepted Answer

Validate that the most recent backups are free from malware and can be restored.. In a ransomware recovery scenario, the first step is to ensure that backups are clean and restorable. Ransomware often targets backups, so validating their integrity prevents restoring malicious code. Once backups are verified, the team can proceed with restoration. This approach aligns with the incident response principle of containing and eradicating the threat before recovery. Skipping validation risks reinfection and further downtime.

Answer

Immediately restore the most recent full backup to the primary data center.

Answer

Rebuild the primary data center from scratch using the original installation media.

Answer

Notify all customers about the data breach and provide credit monitoring services.

Question 11

A software company's incident response plan defines a severity level of 'Critical' for incidents that cause a complete outage of customer-facing services. A developer accidentally deploys a faulty update that crashes the production web servers, making the service unavailable to all customers. Which incident response phase should the team be in when they apply a rollback to the previous working version?

Accepted Answer

Recovery. The recovery phase focuses on restoring systems to normal operation after an incident has been contained and eradicated. Applying a rollback to a previous working version is a recovery action because it brings the production web servers back online and functional. This phase ensures the service is fully restored and verified. It follows containment (limiting impact) and eradication (removing the cause).

Answer

Preparation

Answer

Containment

Answer

Eradication

Question 12

A retail company experiences a distributed denial-of-service (DDoS) attack that overwhelms its online store. The incident response team successfully mitigates the attack, and the store is back online. Which activity should the team perform as part of the post-incident activity phase?

Accepted Answer

Conduct a lessons-learned meeting to identify improvements in the DDoS response process.. After an incident is contained and systems are restored, the post-incident activity phase involves reviewing the event to improve future response. A lessons-learned meeting allows the team to document what happened, identify gaps, and update the incident response plan. This is the key activity that distinguishes post-incident work from ongoing operational tasks.

Answer

Notify law enforcement and press charges against the attackers.

Answer

Immediately reconfigure the firewall to block the attacking IP addresses.

Answer

Restore the online store from the most recent backup.

Question 13

A retail company's business continuity plan includes a requirement to test its disaster recovery capabilities annually. The IT team proposes conducting a tabletop exercise with key stakeholders. Which benefit does this type of test provide?

Accepted Answer

It evaluates the decision-making and communication processes without disrupting live operations.. A tabletop exercise is a discussion-based test that simulates an emergency scenario to evaluate plans, roles, and communication. It does not disrupt live operations and is relatively low-cost. It helps identify gaps in coordination and decision-making. It is not a technical test of recovery systems; instead, it focuses on the human and procedural elements of business continuity and disaster recovery.

Answer

It verifies that the recovery site can handle the production workload within the RTO.

Answer

It provides a full-scale simulation of a disaster to test all technical recovery procedures.

Answer

It automatically updates the disaster recovery plan based on identified gaps during the exercise.

Question 14

A software-as-a-service (SaaS) provider is developing its business continuity plan (BCP). The company wants to ensure it can continue operating during a prolonged power outage at its primary data center. Which element of the BCP should address the alternate power source and its regular testing?

Accepted Answer

Continuity strategies. Continuity strategies are the component of the business continuity plan that outlines how critical functions will be maintained during disruptions, including the use of alternate power sources. They specify the resources, responsibilities, and testing required to ensure the strategy works. The BIA identifies the need, but the strategy provides the solution.

Answer

Incident response plan (IRP)

Answer

Disaster recovery plan (DRP)

Answer

Business impact analysis (BIA)

Question 15

A multinational corporation is reviewing its incident response plan after a recent data breach. The security team wants to ensure that during future incidents, evidence is properly preserved for potential legal action. Which TWO actions should be included in the incident response plan to support forensic readiness? (Choose two.)

Accepted Answer

Establish a chain of custody for all collected evidence.. Forensic readiness requires that evidence be preserved in a way that is admissible in legal proceedings. Establishing a chain of custody ensures evidence integrity, and training responders on evidence handling ensures that procedures are followed correctly. Together, these actions help a multinational corporation maintain credible evidence for potential litigation or regulatory investigations.

Answer

Allow only senior management to access the incident response plan.

Answer

Immediately shut down all affected systems to prevent further data loss.

Answer

Delete all logs after 30 days to reduce storage costs.