Security Policies and Procedures →mediumMultiple Select

200-201 Security Policies and Procedures Practice Question

A security analyst is reviewing the organization's business continuity plan (BCP) after a recent power outage disrupted operations. The analyst notes that the plan includes an alternate processing site and a backup generator but lacks other key components. Which TWO additional elements should the analyst recommend including to improve the BCP? (Choose two.)

⚠ Common exam trap

The trap here is selecting security testing or marketing activities as BCP components when the plan actually requires recovery objectives and clear team responsibilities.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Documented roles and responsibilities for the continuity team

A business continuity plan should define recovery time objectives to set acceptable downtime limits and assign clear roles and responsibilities to the continuity team. These elements ensure that recovery efforts are prioritized and coordinated. The alternate site and generator address infrastructure, but without RTOs and defined roles, the organization cannot measure or manage its recovery effectively.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Documented roles and responsibilities for the continuity team
Why this is correct
This is correct because a BCP must clearly assign roles and responsibilities so that team members know what to do during a disruption. Without defined roles, recovery efforts can stall due to confusion or duplication. The scenario identifies missing components, and role clarity is a fundamental part of any effective continuity plan.
✗
A list of employee personal social media accounts
Why it's wrong here
This is incorrect because personal social media accounts are not relevant to business continuity planning. The BCP focuses on restoring critical business functions, not on employees' personal online presence. Including such a list would not help during a power outage or any other disruption and would introduce unnecessary privacy concerns.
✗
A marketing plan for attracting new customers after the outage
Why it's wrong here
This is incorrect because marketing to new customers is not a business continuity concern. The BCP addresses restoring operations and minimizing downtime, not growth strategies. While customer communication may be part of a crisis plan, attracting new customers is unrelated to recovering from a power outage.
✗
A schedule for regular penetration testing of the alternate site
Why it's wrong here
This is incorrect because penetration testing, while valuable for security, is not a core BCP element. The scenario is about improving continuity after a power outage, and the missing components should address recovery objectives and team structure. Penetration testing does not directly ensure that critical systems can be restored within acceptable timeframes.
✓
A defined recovery time objective (RTO) for critical systems
Why this is correct
This is correct because the RTO specifies the maximum acceptable downtime for critical systems, guiding how quickly recovery must occur. Without an RTO, the organization cannot measure whether its alternate site or generator is sufficient. The scenario notes the BCP lacks key components, and an RTO is essential for prioritizing recovery efforts and validating the plan's effectiveness.

Go deeper

200-201 Security Policies and Procedures Practice Question

Why each option matters

Option-by-option breakdown

Related to this question