ISC Contingency Management — 20 Questions

Question 1

Your organization uses a 'Warm Site' for its disaster recovery strategy. During a recent audit, you find that the site lacks the necessary bandwidth to support peak production traffic. What is the most appropriate management response?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Update the DRP to include a 'throttling' policy for non-critical services during failover.. A warm site must be periodically validated against current production loads to ensure the SLA can be met.

Answer

Cancel the warm site contract and build a cold site.

Answer

Require all employees to work from home during a disaster to save bandwidth.

Answer

Accept the risk formally via the Risk Register without further mitigation.

Question 2

Following a ransomware attack, the organization must decide whether to invoke the DRP or remain in a degraded state while security teams perform forensics. What is the ISSMP's primary responsibility in this decision-making process?

Accepted Answer

Ensuring the decision is documented to align with the organization's risk appetite.. The ISSMP must facilitate the risk-based decision between recovery speed (DRP) and evidence preservation (Forensics).

Answer

Choosing the restore point from the offsite immutable backup.

Answer

Performing the initial forensic image of the infected servers.

Answer

Directing the IT team to disconnect the network immediately.

Question 3

You are auditing a third-party disaster recovery service provider. Which metric provides the most accurate evidence that the provider can meet your organization's required recovery point for a database cluster?

Accepted Answer

Replication Lag monitoring logs showing synchronization latency.. RPO is defined by data loss tolerance, which is best measured by the age of the last successful backup or replication point.

Answer

Mean Time to Recovery (MTTR) reports from previous tests.

Answer

Service Level Agreement (SLA) uptime percentages.

Answer

Annual penetration test results.

Question 4

During a disaster recovery simulation for a hybrid cloud environment, you discover that the automated orchestration tool fails to restore dependencies in the correct order because the cloud provider's metadata tags were purged. What is the most effective administrative control to prevent this during a real event?

Accepted Answer

Enforce mandatory tagging policies using AWS Service Control Policies (SCPs) or Azure Policy.. Maintaining configuration drift control and metadata persistence through Infrastructure as Code (IaC) is essential for automated recovery.

Answer

Increase the RTO buffer time in the Service Level Agreement (SLA).

Answer

Switch from automated restoration to manual snapshot-based restores.

Answer

Implement a manual verification step in the Disaster Recovery Plan (DRP) documentation.

Question 5

Which document serves as the primary governing authority to define the triggers, escalation paths, and communication roles during a declared crisis event?

Accepted Answer

Crisis Management Plan (CMP). The Crisis Management Plan provides the governance for decision-making during a crisis, whereas the DRP focuses on technical restoration.

Answer

Business Impact Analysis (BIA)

Answer

Standard Operating Procedure (SOP)

Answer

Disaster Recovery Plan (DRP)

Question 6

Which of the following is the most effective method for testing the efficacy of a Business Continuity Plan without disrupting production operations?

Accepted Answer

Tabletop exercise.. A tabletop exercise is a discussion-based simulation that tests plan logic and communication without affecting production systems.

Answer

Parallel processing test.

Answer

Cutover test.

Answer

Full-scale simulation.

Question 7

Your organization has adopted a cloud-native microservices architecture. Which strategy is most appropriate for maintaining business continuity in the event of a regional cloud provider outage?

Accepted Answer

Multi-region active-active deployment with global load balancing.. Multi-region deployment with active-active traffic distribution provides the highest level of resilience for cloud-native apps.

Answer

Cross-region cold standby snapshots.

Answer

On-premises hot-site failover.

Answer

Single-region immutable backups.

Question 8

An ISSMP is overseeing a BCP program and notes that the current Business Impact Analysis (BIA) is heavily focused on RTO but lacks a critical dependency mapping for cross-functional business processes. Which specific action should the ISSMP prioritize to address the systemic risk of cascading failure during a disaster?

Accepted Answer

Initiate a value chain analysis using the SCOR model to identify inter-process dependencies.. BIA must move beyond simple RTO/RPO metrics to identify upstream and downstream process dependencies to ensure that recovery orchestration remains viable.

Answer

Implement a redundant secondary site for all identified Tier 1 applications.

Answer

Update the BIA to include qualitative impact assessments for all business units.

Answer

Mandate an immediate increase in the frequency of full-scale BCP simulation exercises.

Question 9

You are implementing a disaster recovery strategy for a database that uses synchronous replication. What is the most significant trade-off you must accept by enforcing this configuration?

Accepted Answer

Increased latency for write operations.. Synchronous replication guarantees zero data loss (RPO=0) but introduces latency overhead on write operations because the commit must wait for the acknowledgment from the secondary site.

Answer

Higher risk of data corruption.

Answer

Increased probability of backup failure.

Answer

Limited scalability of the database cluster.

Question 10

Your organization uses a 'Hot Site' with hardware-level replication. During a disaster, the primary site becomes unavailable, but the failover fails due to a 'Split-Brain' scenario. What is the fundamental cause of this?

Accepted Answer

Loss of the heartbeat connection/quorum service.. Split-brain happens when both sites think they are the primary due to loss of the quorum or heartbeat mechanism.

Answer

Mismatched firmware versions between servers.

Answer

Inadequate storage capacity for incoming logs.

Answer

Insufficient cooling at the hot site.

Question 11

When designing the Crisis Communication Plan, why is it essential to establish pre-approved communication templates?

Accepted Answer

To ensure consistent and rapid messaging during high-stress situations.. During a crisis, speed and accuracy are critical. Templates reduce cognitive load and prevent errors in messaging.

Answer

To allow marketing teams to create brand-focused content.

Answer

To bypass legal review during the crisis.

Answer

To fulfill regulatory requirements for daily status reports.

Question 12

What is the primary objective of a 'lessons learned' meeting conducted after a disaster recovery exercise?

Accepted Answer

Identify gaps in the plan and define remediation actions.. The objective is to identify gaps in the plan based on the exercise results and assign ownership for remediation.

Answer

Update the organizational chart.

Answer

Verify the status of the offsite backup tapes.

Answer

Evaluate the performance of the IT staff for disciplinary purposes.

Question 13

When classifying business processes for BCP, what is the 'Recovery Time Objective' (RTO) most effectively used for?

Accepted Answer

Determining the technology and infrastructure requirements for restoration.. RTO informs the investment and technology choices for the recovery strategy to ensure service restoration occurs within the business-defined window.

Answer

Identifying the critical staff needed for recovery.

Answer

Assessing the data loss tolerance.

Answer

Calculating the financial impact of the event.

Question 14

An ISSMP is revising the BCP to account for 'Supply Chain Resiliency'. Which approach is best for verifying that critical third-party vendors can meet the organization's recovery requirements?

Accepted Answer

Reviewing vendor-provided Disaster Recovery test reports and performance metrics.. Contractual RTO/RPO requirements must be validated via audit or simulation results.

Answer

Sending a self-assessment questionnaire to the vendor.

Answer

Performing an independent penetration test on the vendor's network.

Answer

Requiring vendors to sign an updated Service Level Agreement.

Question 15

During a BCP planning session, the executive team is debating the 'Maximum Tolerable Downtime' (MTD) for a legacy internal application. What is the correct way to define this metric?

Accepted Answer

The total duration of time that an organization can tolerate a business process being unavailable.. MTD is the total time a process can be down before the organization suffers catastrophic/irreversible harm.

Answer

The maximum acceptable age of data in the event of a system crash.

Answer

The time taken to fail over to the secondary site during a disaster.

Answer

The time required to restore the application from the latest tape backup.

Question 16

Your organization has decided to use a 'Cloud Disaster Recovery' service. The vendor provides a 'Pilot Light' strategy. What does this mean for your organization's recovery capability?

Accepted Answer

Core services are running, and the remaining infrastructure can be scaled up on demand.. A pilot light maintains critical core components (e.g., database) in a running state, while application tiers are spun up on-demand during a disaster.

Answer

A complete replica of the production environment is running 24/7.

Answer

The environment only exists as data snapshots in cold storage.

Answer

The environment is hosted on-premises and fails over to a secondary data center.

Question 17

An ISSMP is reviewing the Business Continuity Plan (BCP) for a critical application. Which TWO of the following factors should be considered when defining the 'Maximum Tolerable Downtime' (MTD)?

Accepted Answer

Legal and regulatory compliance requirements.. MTD is defined by financial and operational thresholds, often dictated by contractual obligations or total loss of revenue potential.

Answer

Total expected cost of hardware replacement.

Answer

The current availability of spare parts in the data center.

Answer

The number of employees required to perform manual workarounds.

Question 18

In a decentralized organization, which approach to BCP management ensures both local agility and global alignment?

Accepted Answer

A federated model with a centralized governance framework.. A federated model allows individual business units to customize plans to their specific needs while adhering to a common global framework/policy.

Answer

Leaving BCP entirely to the discretion of local department managers.

Answer

A strictly centralized command-and-control model.

Answer

Outsourcing the entire BCP function to a single managed service provider.

Question 19

Which THREE of the following are essential components of a robust Crisis Management Plan?

Accepted Answer

Clearly defined crisis team roles and responsibilities.. Crisis management requires clear authority, defined communication channels, and a pre-identified team with specific roles.

Answer

An inventory of all software licenses held by the organization.

Answer

Granular technical steps for server restoration.

Question 20

During a BIA review, you need to identify critical assets and their recovery requirements. Which TWO of the following inputs are essential for this classification process?

Accepted Answer

Interviews with business process owners.. The BIA requires both understanding of the process importance and the technical dependencies (what systems are actually used).

Answer

Current data center power consumption logs.

Answer

The organization's current IT procurement strategy.

Answer

Employee performance review records.