Contingency Management

Your organization uses a 'Warm Site' for its disaster recovery strategy. During a recent audit, you find that the site lacks the necessary bandwidth to support peak production traffic. What is the most appropriate management response?

Following a ransomware attack, the organization must decide whether to invoke the DRP or remain in a degraded state while security teams perform forensics. What is the ISSMP's primary responsibility in this decision-making process?

You are auditing a third-party disaster recovery service provider. Which metric provides the most accurate evidence that the provider can meet your organization's required recovery point for a database cluster?

Which document serves as the primary governing authority to define the triggers, escalation paths, and communication roles during a declared crisis event?

Which of the following is the most effective method for testing the efficacy of a Business Continuity Plan without disrupting production operations?

Your organization has adopted a cloud-native microservices architecture. Which strategy is most appropriate for maintaining business continuity in the event of a regional cloud provider outage?

You are implementing a disaster recovery strategy for a database that uses synchronous replication. What is the most significant trade-off you must accept by enforcing this configuration?

Your organization uses a 'Hot Site' with hardware-level replication. During a disaster, the primary site becomes unavailable, but the failover fails due to a 'Split-Brain' scenario. What is the fundamental cause of this?

When designing the Crisis Communication Plan, why is it essential to establish pre-approved communication templates?

What is the primary objective of a 'lessons learned' meeting conducted after a disaster recovery exercise?

During a BCP planning session, the executive team is debating the 'Maximum Tolerable Downtime' (MTD) for a legacy internal application. What is the correct way to define this metric?

Your organization has decided to use a 'Cloud Disaster Recovery' service. The vendor provides a 'Pilot Light' strategy. What does this mean for your organization's recovery capability?

An ISSMP is reviewing the Business Continuity Plan (BCP) for a critical application. Which TWO of the following factors should be considered when defining the 'Maximum Tolerable Downtime' (MTD)?

In a decentralized organization, which approach to BCP management ensures both local agility and global alignment?

Which THREE of the following are essential components of a robust Crisis Management Plan?

During a BIA review, you need to identify critical assets and their recovery requirements. Which TWO of the following inputs are essential for this classification process?

Which TWO of the following are primary risks associated with an 'asynchronous' data replication strategy?

Which THREE of the following strategies should be included in a 'Disaster Recovery Program Oversight' function to ensure long-term viability?

When designing a Disaster Recovery Program, which THREE of the following represent common 'single points of failure' that must be addressed?

Which TWO of the following are effective ways to improve 'Crisis Management Leadership' effectiveness during an incident?

You are the ISSMP for a regional hospital network. The CIO wants assurance that the emergency department's clinical information system can be recovered within its maximum tolerable downtime (MTD) of 30 minutes. The system runs on a three-tier architecture with a relational database. Which recovery strategy BEST satisfies the MTD requirement?

An ISSMP is reviewing the organization's business continuity plan (BCP). The plan defines recovery time objectives (RTOs) and recovery point objectives (RPOs) for critical business processes. The internal audit team has asked for evidence that the BCP will actually work during a disruption. Which action provides the MOST reliable evidence that the BCP is effective?

An ISSMP is developing a contingency plan for a critical e-commerce platform. The organization wants to ensure that the plan addresses both business process recovery and technology recovery. Which TWO of the following components are essential to include in the contingency plan? (Choose two.)

Your organization runs its order-management platform in an active-active configuration across two data centers, with a third site reserved for disaster recovery. During a quarterly BCP exercise, the CIO asks you to define the maximum acceptable time that transaction data may be irretrievably lost if the primary site fails before replication completes. Which contingency metric should you present?

A hospital's emergency department depends on a clinical documentation system. The BIA shows the department can function on paper forms for up to four hours, after which patient safety risk becomes unacceptable. The DR plan states the system will be restored within six hours. What should the contingency manager do FIRST?

A financial services firm has a primary data center and a cold DR site 120 miles away. A risk assessment reveals that the maximum tolerable downtime (MTD) for the core banking application is 8 hours, but the DR plan requires 24 hours to restore from tape backups at the cold site. The business continuity manager must close this gap. Which action is the MOST effective immediate step?

A multinational corporation is reviewing its business continuity plan (BCP). The BCP includes a recovery strategy for its primary ERP system that relies on a hot site with synchronous replication. During a tabletop exercise, participants discover that the hot site is in the same seismic zone as the primary data center. Which of the following is the MOST critical risk to address?

A healthcare organization is developing its crisis management plan. The plan must address how the organization will coordinate with external entities during a public health emergency. Which of the following is the PRIMARY purpose of including a call tree and contact list in the crisis management plan?

A retail company is conducting a business impact analysis (BIA) for its point-of-sale (POS) system. The BIA team has identified that a 4-hour outage would result in $500,000 in lost sales and reputational damage. The company's risk appetite allows for a maximum of 2 hours of downtime for critical systems. Which of the following should be the PRIMARY output of this BIA for the POS system?

A global manufacturing company is updating its crisis management plan. The plan must address the unique challenges of a cyber-related crisis, such as a ransomware attack that encrypts critical production systems. Which TWO of the following are the MOST important elements to include in the crisis management plan for this scenario? (Choose two.)

A financial services firm has a primary data center in a flood plain and a contractual obligation to resume trading operations within two hours of any disruption. The CIO proposes replacing the current cold site with a mirrored hot site in a different seismic zone, but the CFO objects to the recurring cost. Which action best supports a defensible decision while preserving the two-hour commitment?

A regional utility has completed its business impact analysis and is now selecting recovery strategies for its supervisory control and data acquisition environment. The BIA shows that loss of grid monitoring beyond 30 minutes creates public safety risk. Which recovery strategy characteristic is most important when selecting the target environment for this system?

A multinational manufacturer is updating its contingency management framework after a prolonged supplier outage disrupted production. Executive leadership wants assurance that future disruptions are detected early and that recovery priorities remain aligned with business objectives. (Choose two.)

During a crisis simulation, the incident commander discovers that the crisis management team has no pre-agreed criteria for escalating from the operational incident response team to the executive crisis team. Decisions are being made ad hoc and communication is inconsistent. Which action best addresses this governance gap?