20+ practice questions focused on Business Continuity, DR & Incident Response — one of the most tested topics on the ISC2 Certified in Cybersecurity CC exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Business Continuity, DR & Incident Response PracticeDuring a ransomware incident, the incident response team isolates affected systems. Which of the following is the NEXT best step?
Explanation: After isolating affected systems during a ransomware incident, the next best step is to preserve forensic evidence from those systems. This ensures that data such as memory dumps, logs, and encrypted files are captured intact for analysis, which is critical for understanding the attack vector, identifying the ransomware variant, and potentially recovering data without paying the ransom. Forensic preservation must occur before any remediation steps like wiping or rebuilding, as those actions would destroy the evidence needed for investigation and legal proceedings.
An organization's recovery time objective (RTO) for its customer database is 4 hours. During a disaster, the backup restore process takes 2 hours, but reconfigure and test tasks add another 3 hours. Which action best addresses this gap?
Explanation: The RTO is 4 hours, but the actual recovery time is 2 hours (restore) + 3 hours (reconfigure and test) = 5 hours, exceeding the RTO by 1 hour. Automating the configuration and validation steps (option D) reduces the post-restore manual effort, bringing the total recovery time closer to or within the 4-hour RTO. This directly addresses the gap without altering the RTO or neglecting testing.
A SOC analyst receives an alert indicating a user executed a PowerShell script that initiated outbound connections to an external IP. The script was delivered via email attachment. Which incident response phase is MOST appropriate for containing this threat?
Explanation: Option B (Eradication phase) is correct because containment actions such as removing the malicious PowerShell script, terminating the outbound connections, and cleaning the affected system are part of the eradication phase. The incident response lifecycle (NIST SP 800-61) places containment, eradication, and recovery as sequential steps after identification; here, the alert has already been identified, so the most appropriate next step is to eradicate the threat by removing the script and blocking the external IP.
A company's business continuity plan includes an alternate work site with full IT capabilities. Which type of recovery site does this describe?
Explanation: A hot site is a fully equipped alternate work site with all necessary IT infrastructure—servers, networking, telecommunications, and power—ready to take over operations immediately. The question specifies 'full IT capabilities,' which aligns with the hot site's purpose of enabling rapid failover with minimal downtime, typically within hours.
An organization uses a primary data center and a backup site 500 miles away. The backup site replicates data synchronously. Which risk is MOST likely introduced by this configuration?
Explanation: Synchronous replication requires the primary site to wait for an acknowledgment from the backup site before completing each write operation. The 500-mile distance introduces a minimum round-trip latency of approximately 8-10 ms (based on fiber optic propagation at ~200 km/ms), which directly increases the time taken for write operations. This latency impact is the most likely risk introduced by this configuration.
+15 more Business Continuity, DR & Incident Response questions available
Practice all Business Continuity, DR & Incident Response questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Business Continuity, DR & Incident Response. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Business Continuity, DR & Incident Response questions on the CC frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Business Continuity, DR & Incident Response is tested as part of the ISC2 Certified in Cybersecurity CC blueprint. Practicing with targeted Business Continuity, DR & Incident Response questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free CC practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Business Continuity, DR & Incident Response is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Business Continuity, DR & Incident Response practice session with instant scoring and detailed explanations.
Start Business Continuity, DR & Incident Response Practice →