20+ practice questions focused on Business Continuity, DR & Incident Response — one of the most tested topics on the ISC2 Certified in Cybersecurity CC exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Business Continuity, DR & Incident Response PracticeAn organization's recovery time objective (RTO) for its customer database is 4 hours. During a disaster, the backup restore process takes 2 hours, but reconfigure and test tasks add another 3 hours. Which action best addresses this gap?
Explanation: The RTO is 4 hours, but the actual recovery time is 2 hours (restore) + 3 hours (reconfigure and test) = 5 hours, exceeding the RTO by 1 hour. Automating the configuration and validation steps (option D) reduces the post-restore manual effort, bringing the total recovery time closer to or within the 4-hour RTO. This directly addresses the gap without altering the RTO or neglecting testing.
A SOC analyst receives an alert indicating a user executed a PowerShell script that initiated outbound connections to an external IP. The script was delivered via email attachment. Which incident response phase is MOST appropriate for containing this threat?
Explanation: When an alert is received, identification has already occurred. The next step is to contain the threat, which is typically part of the eradication phase in the ISC2 CC framework. Containment activities such as isolating the system and blocking connections are performed during the eradication phase. Therefore, option B (Eradication phase) is the most appropriate for containing the threat.
After a security incident has been contained and eradicated, which of the following should be done to improve future incident response?
Explanation: A post-incident review (also called a lessons-learned meeting) is the correct next step after containment and eradication because it systematically analyzes what went wrong, what worked, and what can be improved in the incident response plan. This review directly feeds into updating playbooks, refining detection rules, and adjusting security controls to prevent recurrence. Without this step, the organization misses the opportunity to close the loop on the incident lifecycle and may repeat the same mistakes.
In a cloud environment, the security team discovers that a misconfigured cloud storage bucket has made customer data publicly accessible. After securing the bucket, what is the most important next step?
Explanation: After securing a misconfigured cloud storage bucket that exposed customer data, the most important next step is to notify affected customers. This aligns with incident response best practices and regulatory requirements (e.g., GDPR, HIPAA) that mandate timely disclosure of data breaches to impacted individuals. Without notification, the organization may face legal penalties and loss of trust, even if the data is now secure.
During a ransomware incident, the incident response team isolates affected systems. Which of the following is the NEXT best step?
Explanation: After isolating affected systems during a ransomware incident, the next best step is to preserve forensic evidence from those systems. This ensures that data such as memory dumps, logs, and encrypted files are captured intact for analysis, which is critical for understanding the attack vector, identifying the ransomware variant, and potentially recovering data without paying the ransom. Forensic preservation must occur before any remediation steps like wiping or rebuilding, as those actions would destroy the evidence needed for investigation and legal proceedings.
+15 more Business Continuity, DR & Incident Response questions available
Practice all Business Continuity, DR & Incident Response questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Business Continuity, DR & Incident Response. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Business Continuity, DR & Incident Response questions on the CC frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Business Continuity, DR & Incident Response is tested as part of the ISC2 Certified in Cybersecurity CC blueprint. Practicing with targeted Business Continuity, DR & Incident Response questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free CC practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Business Continuity, DR & Incident Response is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Business Continuity, DR & Incident Response practice session with instant scoring and detailed explanations.
Start Business Continuity, DR & Incident Response Practice →