ISC2 CC Business Continuity, Disaster Recovery, and Incident Response — Timed 30 Questions

Question 1

A company experiences a ransomware attack that encrypts all files on a file server. The IT team decides to restore the server from the most recent full backup taken 24 hours ago, followed by all differential backups taken since then. If the last full backup was on Sunday at midnight, and the attack occurs on Wednesday at 6:00 AM, with differential backups taken daily at noon, how many differential backups must be restored?

30 minute time limit — choose an answer to begin.

Accepted Answer

2. Differential backups contain changes since the last full backup. The last full backup was Sunday midnight. Differential backups were taken Monday noon, Tuesday noon, and Wednesday noon (but the attack was at 6 AM Wednesday, so Wednesday's backup hadn't occurred yet). So differential backups available: Monday and Tuesday. That's 2 differential backups to restore.

Answer

3

Answer

4

Answer

1

Question 2

An organization's business continuity plan designates a maximum tolerable downtime (MTD) of 8 hours for its order processing system. The system's recovery time objective (RTO) is set at 4 hours, and work recovery time (WRT) is estimated at 2 hours. If a disaster occurs at 10:00 AM and the system is restored at 2:00 PM, but additional configuration and data validation take until 3:30 PM to complete, what is the total downtime and is the MTD met?

Accepted Answer

5.5 hours, MTD met. Total downtime is from disaster at 10:00 AM to full restoration at 3:30 PM, which is 5.5 hours. The MTD is 8 hours, so 5.5 hours is within the MTD, meaning the MTD is met. The RTO (4 hours) is the time to restore the system, which was 4 hours (10 AM to 2 PM), and WRT (2 hours) is additional work to validate, totaling 6 hours? Wait, 10 AM to 3:30 PM is 5.5 hours. RTO 4 hours + WRT 2 hours = 6 hours, but actual is 5.5 hours. The question asks total downtime and if MTD met. 5.5 hours < 8 hours, so met. Correct answer B.

Answer

4 hours, MTD exceeded

Answer

4 hours, MTD met

Answer

5.5 hours, MTD exceeded

Question 3

A small business wants to minimize backup storage space and backup time, knowing that restoration may be slower. Which backup strategy should they choose?

Accepted Answer

Incremental backup daily. Incremental backup daily backs up only the data changed since the last backup (whether full or incremental), minimizing backup storage space and backup time. The trade-off is that restoration requires the last full backup plus every incremental since, making restoration slower and more complex. This matches the requirement to minimize storage and time at the cost of slower restoration.

Answer

Full backup weekly and incremental daily

Answer

Full backup daily

Answer

Differential backup daily

Question 4

During an incident, the security team detects unusual outbound traffic from a server that normally does not communicate externally. The traffic appears to be encrypted and is sent to an unknown IP address. Which incident category best describes this scenario?

Accepted Answer

Data breach. Unusual encrypted outbound traffic to an unknown IP from a server that normally does not communicate externally is a classic indicator of data exfiltration, which falls under the data breach category. The encryption suggests the attacker is hiding stolen data, and the unknown destination indicates unauthorized transfer of sensitive information.

Answer

Malware

Answer

Denial of service

Answer

Social engineering

Question 5

A healthcare organization suffers a data breach involving protected health information (PHI). The incident occurred on Monday, and the organization discovers it on Wednesday. Under GDPR, if the breach affects EU residents, what is the deadline for notifying the supervisory authority?

Accepted Answer

Saturday. GDPR Article 33 requires notification of a personal data breach to the supervisory authority within 72 hours of becoming aware of it. The organization discovered the breach on Wednesday, so the deadline is 72 hours later — Saturday. The clock starts at awareness, not at the time the breach occurred, which is why the Monday breach date is irrelevant to the deadline calculation.

Answer

Wednesday (day of discovery)

Answer

Thursday

Answer

Monday (day of breach)

Question 6

An organization determines that its critical financial application has a maximum tolerable downtime (MTD) of 8 hours. The recovery time objective (RTO) is set to 6 hours, and the work recovery time (WRT) is 2 hours. If the application is restored from backup in 5 hours, but additional configuration takes 3 hours, what is the total downtime, and is the MTD met?

Accepted Answer

Total downtime 8 hours, MTD met. Total downtime is the sum of the time to restore from backup (5 hours) and the additional configuration time (3 hours), which equals 8 hours. Since the MTD is 8 hours, the downtime exactly meets the maximum tolerable downtime, so the MTD is met. The RTO (6 hours) and WRT (2 hours) sum to 8 hours, which is the maximum allowed downtime; the actual downtime of 8 hours is within the MTD.

Answer

Total downtime 10 hours, MTD exceeded

Answer

Total downtime 8 hours, MTD exceeded

Answer

Total downtime 5 hours, MTD met

Question 7

During a BIA, the maximum tolerable downtime for a critical application is determined to be 4 hours. The IT team estimates system recovery will take 2 hours, but additional manual work to reconcile data will take 1 hour. What is the Recovery Time Objective (RTO)?

Accepted Answer

2 hours. RTO is the maximum acceptable time to restore a system or application after a disruption, and it is defined by the business requirement, not by how long recovery actually takes. The BIA established an MTD of 4 hours, and the RTO is the target recovery time the business sets within that window — here, 2 hours, matching the IT team's system recovery estimate.

Answer

1 hour

Answer

4 hours

Answer

3 hours

Question 8

A company has a Recovery Point Objective (RPO) of 1 hour for its financial database. It performs full backups every night at 11 PM and incremental backups every 4 hours. If the system fails at 2:30 PM, what is the maximum data loss in terms of time?

Accepted Answer

3.5 hours. The maximum data loss is the time between the last successful backup and the failure. Full backup at 11 PM, then incremental backups every 4 hours: 3 AM, 7 AM, 11 AM, 3 PM. Since the failure occurs at 2:30 PM, the most recent backup before failure is the 11 AM incremental. Data loss is therefore from 11 AM to 2:30 PM, which is 3.5 hours. The RPO of 1 hour is a requirement, not the actual data loss; the schedule as given results in up to 3.5 hours of data loss, exceeding the RPO. Option C is correct.

Answer

1 hour

Answer

15.5 hours

Answer

1.5 hours

Question 9

An organization needs to prioritize recovery of systems after a disaster. Which metric directly indicates the maximum acceptable outage time for a business function?

Accepted Answer

Maximum Tolerable Downtime (MTD). Maximum Tolerable Downtime (MTD) is the total time a business function can be unavailable before unacceptable consequences occur — it is the maximum acceptable outage time. RTO is the target time to restore the system, which must be less than MTD, but MTD itself is the metric that directly expresses the maximum tolerable outage.

Answer

Recovery Time Objective (RTO)

Answer

Recovery Point Objective (RPO)

Answer

Work Recovery Time (WRT)

Question 10

A company is implementing a backup strategy. Which TWO of the following are characteristics of incremental backups? (Choose two.)

Accepted Answer

Fast backup process. Option D is correct because an incremental backup only captures data that has changed since the most recent backup of any kind, so the backup job itself completes quickly and consumes minimal time and resources. Option E is correct because the defining characteristic of an incremental backup is that it backs up only data changed since the last backup, whether that previous backup was full, differential, or incremental. Options A and C are incorrect: option A describes a differential backup (changed since the last full backup), and option C is inaccurate because incremental backups use less space than full backups but the claim of 'least storage space of all backup types' is not a defining characteristic and depends on the environment. Option B is incorrect because incremental backups actually require a slower, more complex restore process, since the last full backup plus every subsequent incremental backup must be applied in sequence.

Answer

Backs up data changed since the last full backup

Answer

Fast restore process

Answer

Requires the least storage space of all backup types

Question 11

Which TWO of the following are common indicators of a potential data breach? (Choose two.)

Accepted Answer

Unauthorized access to sensitive files. Option A (Unauthorized access to sensitive files) is a correct indicator because it directly demonstrates a violation of access controls, such as a user reading files outside their role or an attacker using compromised credentials to open confidential data, which is a hallmark of exfiltration or lateral movement. Option E (Unusual outbound network traffic) is also correct because large or anomalous outbound flows to unknown external IPs or non-standard ports often signal command-and-control communication, data exfiltration, or malware beaconing. Option D (Multiple failed login attempts from a single account) is not marked correct here because, while it is a common indicator of brute-force or password-spraying attempts, the question asks for indicators of a potential data breach rather than of an attempted intrusion, and failed logins alone do not show that data was accessed. Option B (Increased employee productivity) is not a security indicator at all and has no causal link to a breach. Option C (Regular software updates) is a preventive maintenance activity that reduces risk and is not evidence of a breach.

Answer

Increased employee productivity

Answer

Regular software updates

Answer

Multiple failed login attempts from a single account

Question 12

An organization's backup schedule: Full backup every Sunday, incremental backups Monday-Saturday. If a failure occurs on Thursday, how many backup sets are needed to restore the data?

Accepted Answer

4 (Sunday full and Monday, Tuesday, Wednesday incrementals). For incremental backups, you need the last full backup and all incrementals since then. So Sunday full + Monday, Tuesday, Wednesday incrementals (4 sets).

Answer

5 (Sunday full and all incrementals through Thursday)

Answer

1 (Sunday full only)

Answer

2 (Sunday full and Wednesday incremental)

Question 13

An organization is choosing a backup strategy to minimize restore time. Which TWO backup types require only the most recent full backup and the latest differential backup to restore?

Accepted Answer

Full backup. Option A (Full backup) is correct because a full backup captures the entire dataset at a point in time, so it serves as the complete base image needed for a restore; in a differential restore scenario, the most recent full backup is the foundation that the latest differential is applied to. Option E (Differential backup) is correct because a differential backup contains all changes made since the last full backup, meaning restoring requires only the last full backup plus the single most recent differential backup, which minimizes restore time compared to replaying a chain of incrementals. Option B (Synthetic full backup) is not correct here because, although it produces a full-equivalent image by consolidating a prior full with subsequent incrementals, the question asks for the two backup types that together require only the most recent full and latest differential; a synthetic full is itself a full image and does not pair with a differential in that restore model. Option C (Incremental backup) is not correct because restoring from incrementals requires the last full backup plus every incremental in the chain up to the desired point, which increases restore time and steps. Option D (Reverse incremental backup) is not correct because it maintains a full plus a chain of reverse incrementals, and restore typically requires the full and potentially multiple reverse incremental steps, not a single differential.

Answer

Synthetic full backup

Answer

Incremental backup

Answer

Reverse incremental backup

Question 14

A company's critical database must be recovered within 4 hours after a disaster, and they can tolerate losing up to 1 hour of data. During a disaster, after the systems are restored, it takes an additional 30 minutes to verify data integrity and resume normal operations. Which metric is represented by the 4-hour requirement?

Accepted Answer

Recovery Time Objective (RTO). The 4-hour requirement defines the maximum acceptable time to restore the database and resume operations after a disaster, which is the Recovery Time Objective (RTO). RTO specifically measures how quickly a system must be brought back online following disruption. The additional 30 minutes for integrity verification is part of the overall recovery window, but the 4-hour target itself is the RTO.

Answer

Maximum Tolerable Downtime (MTD)

Answer

Recovery Point Objective (RPO)

Answer

Work Recovery Time (WRT)

Question 15

During a disaster recovery test, the IT team discovers that restoring all data from full backups takes 48 hours, exceeding the RTO. Which backup strategy would reduce restore time while maintaining a similar backup window?

Accepted Answer

Using differential backups instead of incremental. A differential backup backs up all changes since the last full backup, so restore requires only the full backup and the latest differential, reducing restore time compared to incremental.

Answer

Increasing backup frequency to hourly

Answer

Implementing the 3-2-1 backup rule

Answer

Switching from full to incremental backups only

Question 16

A company is selecting a recovery site strategy. Which TWO factors should be considered when choosing between a hot site and a warm site? (Select TWO.)

Accepted Answer

Cost. Option B (Cost) is correct because a hot site is a fully equipped, mirrored facility with redundant hardware, real-time replication, and continuous power and network connectivity, making it far more expensive to build and maintain than a warm site, which has hardware and connectivity but lacks live data and may require restoration from backups. Option E (Recovery Time Objective, RTO) is correct because the RTO defines the maximum acceptable downtime after a disruption; a hot site enables near-zero or minutes-level recovery, while a warm site typically requires hours to restore data and bring systems online, so the required RTO directly drives the hot-versus-warm decision. Option A (Number of employees) is not a primary selection factor, since staffing affects operational procedures rather than the site's technical recovery capability. Option C (Color of the server racks) is irrelevant to recovery strategy and has no bearing on availability or cost. Option D (Type of operating system) does not determine the site type, because both hot and warm sites can host the same OS platforms; the differentiator is data currency and readiness, not the OS itself.

Answer

Number of employees

Answer

Color of the server racks

Answer

Type of operating system

Question 17

An organization is implementing backup strategies. Which THREE are characteristics of differential backups? (Select THREE)

Accepted Answer

Requires only the last full backup and the latest differential backup for a full restore. Option C is correct because a differential backup chain consists of the last full backup plus the most recent differential backup, so only those two sets are needed to perform a full restore. Option D is correct because a differential backup by definition captures all data that has changed since the last full backup, not since the last incremental or differential backup. Option E is correct because restoring from a differential backup requires fewer backup sets (just the full plus the latest differential) than restoring from an incremental chain, which may require many incremental backups, making restore time generally faster. Option A is incorrect because differential backups typically take longer than incremental backups, since they accumulate all changes since the last full backup rather than only changes since the last backup. Option B is incorrect because it describes incremental backups, which require the last full backup plus every incremental backup in the chain, not all differential backups.

Answer

Backup time is generally faster than incremental backups

Answer

Requires all differential backups since the last full backup for a full restore

Question 18

An incident response team is analyzing a data breach. Which THREE actions are part of the 'Lessons Learned' phase? (Select THREE)

Accepted Answer

Documenting the timeline of events and actions taken. Option B is correct because documenting the timeline of events and actions taken is a core Lessons Learned activity — the post-incident report must capture when the breach was detected, contained, eradicated, and recovered so the team can reconstruct the incident accurately. Option C is correct because updating the incident response plan based on findings is the primary output of the Lessons Learned phase; identified gaps in detection, escalation, or communication are folded back into the IR plan, playbooks, and controls to improve future response. Option D is correct because conducting a post-incident review meeting with all stakeholders (often called a hot wash or after-action review) is the formal Lessons Learned activity where the team and business owners discuss what worked, what failed, and what to change. Option A is not part of Lessons Learned — root cause analysis is performed during the containment, eradication, and recovery phase (or in the investigation that feeds the review), not as a Lessons Learned action itself. Option E is not part of Lessons Learned — isolating affected systems is a containment action executed during the active incident response, well before the Lessons Learned phase begins.

Answer

Identifying the root cause of the breach

Answer

Isolating affected systems to prevent further damage

Question 19

During a ransomware incident, the incident response team has completed the containment and eradication phases. According to the NIST incident response framework, which THREE of the following activities are part of the post-incident activity phase?

Accepted Answer

Conduct a lessons learned meeting to identify improvements.. Option A is correct because the NIST SP 800-61 post-incident activity phase explicitly includes conducting a lessons learned meeting (also called a post-mortem or after-action review) to identify what worked, what failed, and where the IR plan and procedures need improvement. Option B is correct because retaining evidence and logs for legal or regulatory purposes is a post-incident activity; NIST calls for preserving forensic data, documentation, and records in case of prosecution, civil action, or compliance audits, and for defining retention policies. Option D is correct because updating the incident response plan based on findings from the lessons learned session is a core post-incident step, ensuring the plan, playbooks, and controls are revised to prevent recurrence and improve future response. Option C is not part of the post-incident phase as defined by NIST; breach notification to affected customers is a legal/communications obligation typically handled during or immediately after containment and eradication, not a post-incident activity. Option E is also not post-incident; hardening system configurations to prevent reinfection belongs to the eradication and recovery phases, where vulnerabilities are remediated and systems are rebuilt before returning to production.

Answer

Notify affected customers of the data breach.

Answer

Harden system configurations to prevent reinfection.

Question 20

A company is evaluating backup strategies for its critical database. Which TWO of the following are correct statements about backup types?

Accepted Answer

A full backup copies all data regardless of change status.. Option A is correct because a full backup copies the entire data set regardless of whether files or blocks have changed, providing a complete self-contained copy of the database. Option C is correct because a differential backup captures all data modified since the last full backup, so each successive differential grows larger until the next full backup resets the baseline. Option B is not necessarily true: restoring a full backup alone may be faster, but a differential restore requires the last full backup plus the latest differential, so the comparison depends on the scenario. Option D is wrong because an incremental backup copies data changed since the last backup of any type (full or incremental), not since the last full backup. Option E is not universally correct: incremental backups are typically smaller than differentials, but the statement is not one of the marked correct answers and depends on change rates and backup frequency.

Answer

Restoring from a full backup is faster than restoring from a differential backup.

Answer

An incremental backup only copies data that has changed since the last full backup.

Answer

Incremental backups require less storage space than differential backups.