CCNA Information Systems Operations and Business Resilience Questions

Defining dependencies within the job scheduler ensures the failing job only starts once its prerequisite files exist, directly addressing the missing dependency file constraint. The scheduler evaluates these conditions before execution, blocking the run rather than allowing failure. This prevents recurrence through automated precondition checking, unlike manual verification or post-failure alerting.

The 8-hour disruption tolerance defines the recovery time objective, the maximum acceptable downtime before the process must be restored. The 15-minute data loss limit defines the recovery point objective, the maximum tolerable data loss measured backwards from the incident.

The alternate facility needs 24 hours to become operational, but the critical process tolerates only 12 hours of downtime, so recovery exceeds the MTD by 12 hours. The gap is the mismatch between facility activation time and the required recovery timeframe.

Backup encryption at rest protects the transactional log and full backup files stored offsite, directly satisfying the auditor's verification objective. Because log backups occur every 15 minutes, each resulting file must be encrypted before leaving the environment, ensuring confidentiality of data at the offsite storage location.

Advance notification lets stakeholders prepare for service disruption and staff the test, preventing the interruption from being mistaken for a genuine disaster. This satisfies the stem's full interruption scenario, where unannounced downtime could trigger unnecessary escalation.

Routine firewall security patching fits the standard change model because it is pre-approved, low-risk, and repeatable, following a documented procedure with no CAB review required. This satisfies the stem's constraint that standard changes are pre-authorised, low-risk, and executed without individual assessment.

A tabletop exercise gathers participants to walk through roles, decisions and communications against a hypothetical scenario, with no systems activated and no relocation. This discussion-based format contrasts with functional, simulation and full-interruption tests, which involve actual system or site activation.

A normal change is defined by its adherence to the full change management process, requiring formal assessment and authorisation. The scenario's explicit mention that the change requires approval from the Change Advisory Board (CAB) directly aligns with this classification. Additionally, scheduling the implementation during a future maintenance window signifies a planned, non-urgent deployment, confirming it follows the structured workflow typical of a normal change, rather than an emergency or pre-approved standard change.

Sanitisation destroys residual data on decommissioned server drives, preventing recovery of sensitive information before the hardware leaves organisational control. Verifying this control confirms the confidentiality constraint in the disposition process is met, since disposal without media cleansing exposes data to unauthorised parties.

A right-to-audit clause contractually guarantees the IS auditor independent access to the provider's controls, records and evidence. Without it, the organisation cannot verify that the outsourced service meets its security and compliance obligations, leaving assurance dependent solely on the provider's own reporting.

Normal changes require CAB review and authorisation before implementation. Even though the patch is low impact, the reboot and database scope mean the CAB must review and approve it, satisfying the stem's normal-category constraint rather than auto-approving it as standard.

Sustained CPU utilisation above 90% with no proactive capacity planning leaves no headroom for demand spikes, so response times degrade and components may fail. The primary risk is therefore service degradation or unplanned outages affecting dependent business processes.

A right-to-audit clause contractually grants the organisation the ability to inspect the provider's controls, evidence and processes. This directly satisfies the stem's verification constraint, since without it the outsourcer could refuse audits, leaving control effectiveness unconfirmed.

A warm site pre-installs hardware and connectivity but lacks live replicated data, so it restores from backups within hours or days. This sits between cold and hot sites on the cost-versus-recovery-time axis, meeting the medium-sized organisation's need to balance budget against acceptable downtime while sited away from the earthquake zone.

MTD defines the maximum time a process can be unavailable, and the RTO must be set at or below it to keep downtime tolerable. Deriving the RTO from the 4-hour MTD ensures recovery capabilities align with business tolerance.

Dependency management ensures a job only starts once its prerequisite jobs complete successfully, preventing the failure caused by unmet dependencies. It directly addresses the scheduling constraint in the stem, unlike restart or notification controls that react after the job has already failed.

A customer and partner communications plan ensures external stakeholders receive timely, accurate notifications during disruption, protecting reputation and contractual obligations. It satisfies the strategy's requirement to address interdependent parties, since continuity depends on coordinated messaging rather than internal recovery alone.

Emergency patching of critical vulnerabilities on internet-facing systems is a legitimate risk response when the exposure window is short. What makes it acceptable is compensating control: a documented approval by an authorized person, a tested rollback plan in case the patch breaks the service, and verification after deployment that the patch applied and the service functions. This balances the security risk of delay against the operational risk of untested change.

Without an approved maintenance window, maintenance activities can overlap with production processing, and any resulting outage cannot be traced to an authorized change. The auditor's primary concern is that maintenance on power infrastructure must be coordinated, approved, and recorded so that availability risk is controlled and accountability is maintained. Undocumented timing removes the audit trail and increases the chance of an unplanned service interruption.

A hot standby site maintains continuously synchronised infrastructure with near-zero data loss, comfortably satisfying the 30-minute RPO and 2-hour RTO. Because systems run live and replicate in real time, failover completes within minutes, unlike warm or cold alternatives requiring rebuild time that would breach both objectives.

A parallel test processes live transactions at the alternate site while the primary site continues running, satisfying the stem's requirement that the primary is not shut down. Unlike full failover, both sites operate simultaneously, validating recovery capability without disrupting production.

Subcontractors managing storage introduce vendor concentration risk: the provider's reliance on a single subcontractor means an outage, insolvency or service failure at that third party cascades directly to the organisation, yet the contract grants no visibility, audit rights or service-level guarantees over that dependency.

The proposed Recovery Time Objective (RTO) of 2 hours is acceptable because it directly satisfies the critical business continuity constraint established by the Maximum Tolerable Downtime (MTD) of 4 hours. For any recovery strategy to be effective, the RTO, representing the target time to restore operations, must always be less than or equal to the MTD. This ensures that the process can resume before the organisation incurs unacceptable losses, which is met in this scenario.

MTD defines the longest a process can be unavailable before unacceptable business impact occurs, directly setting the recovery time objective and driving continuity strategy. During a BIA, it is the primary metric quantifying tolerable outage per critical process, making it the most important figure to establish.

A right-to-audit clause extending to subcontractors gives the organisation contractual authority to examine fourth-party controls directly, closing the oversight gap created by reliance on vendor-managed compliance. Without it, assurance depends entirely on vendor reporting. This satisfies the stem's constraint: no direct oversight of the fourth party exists, so enforceable audit access must be established contractually.

If problems are not resolved by addressing root causes, the underlying issues persist and generate recurring incidents. This leads to increased incident volume and reduced service availability, as the same problems disrupt services repeatedly. The auditor should recognize that effective problem management is essential to prevent incident recurrence and improve overall stability. This is the most direct consequence.

Undocumented manual reruns mean the ledger update depends on informal operator knowledge rather than a controlled procedure. If the operator is absent or the rerun is performed incorrectly, financial data may be incomplete or posted late without detection. The auditor's key concern is that a recurring failure has been normalized into an uncontrolled workaround, bypassing scheduling, approval, and monitoring controls over a financially significant batch process.

A right-to-audit clause contractually grants the organisation and its IS auditors the authority to examine the provider's controls, evidence and processes. Without it, the provider can lawfully refuse access, so this clause directly satisfies the requirement to assess third-party controls.

A nightly full backup means up to 24 hours of data could be lost, far exceeding the 15-minute RPO, and weekly offsite shipment means recovery after a site loss could depend on tapes that are days old. This is the most significant finding because the strategy cannot meet the defined recovery objectives at all, leaving the business exposed to substantial data loss and extended outage.

A service desk exists to give users one consistent entry point for logging incidents and service requests, ensuring nothing is lost across multiple channels. This single-point-of-contact function is its defining purpose, distinct from resolution, which second-level and specialist teams perform.

A crisis management team with defined roles ensures that during a disaster, there is clear leadership and decision-making. This addresses the gap in roles and responsibilities. The team should include representatives from IT, business units, and communications. Clear authority helps avoid confusion and delays. This is a key recommendation to improve the ITSCP's effectiveness and alignment with the BCP.

Once a vendor ends support, no further security patches or vulnerability fixes are released, leaving known exploits permanently unpatched on production servers. This exposes the organisation to compromise and non-compliance, since compensating controls cannot fully substitute for vendor-supplied remediation.

Automated licence optimisation tools continuously reconcile installed software against entitlements, reclaiming unused seats and flagging over-deployment before true-up audits. This directly satisfies the stem's consideration of ongoing licence management, since manual tracking cannot scale across large estates and typically causes compliance breaches or unnecessary spend.

Without forecasting or trend analysis, capacity shortfalls during predictable peaks such as month-end can lead to resource exhaustion, causing outages or severe performance degradation. This directly threatens service availability and business operations. The risk is significant because the organization already experiences high utilization and has no forward-looking process to anticipate and remediate capacity constraints before they impact users.

RAID 5 tolerates only one simultaneous disk failure, storing parity across all member disks. With one disk already failed, the array runs in degraded mode with no redundancy; a second failure during rebuild leaves insufficient parity to reconstruct missing data, so the volume is lost. This satisfies the stem's double-failure constraint.

P1 denotes the highest priority, reserved for incidents causing critical business impact or major service outage, demanding immediate response and continuous effort until resolution. This matches the ITIL priority matrix, where priority derives from impact and urgency, so P1 definitions must reflect severe disruption requiring escalation.

Tracking utilisation trends over time reveals gradual growth before thresholds are breached, enabling forecasting and timely scaling. This satisfies the stem's requirement for proactive capacity management, since trend analysis anticipates future demand rather than reacting to incidents. Point-in-time monitoring alone would be reactive, whereas historical baselines support informed planning decisions.

End-of-life software no longer receives vendor security patches, so known vulnerabilities remain unmitigated and exploitable. This is the most significant risk because it directly exposes the organisation to compromise, outweighing the lesser concerns of reduced support or licence compliance.

This is the most significant risk because without a capacity plan, the organization cannot proactively address resource constraints. High utilization and I/O wait times indicate the server is near its limits, and any further growth or unexpected demand could cause performance degradation or outages, directly impacting SLAs.

Resolving by 2:00 PM satisfies the four-hour SLA window starting at 10:00 AM, giving the critical incident team the full mandated response period. Any later resolution breaches the defined service commitment, triggering escalation and SLA penalty provisions under the organisation's incident management process.

Offsite storage places backup media beyond the reach of site-specific events such as fire, flood or theft that could destroy both production systems and locally held copies. This satisfies the recoverability requirement by ensuring a surviving copy exists after a site-wide disaster.

Known errors in the KEDB should drive permanent fixes through problem management, eliminating recurrence. Resolution averaging six hours against a four-hour SLA, with recurring known errors, shows problem management is not converting KEDB entries into root-cause resolutions.

Incremental backups capture only changes since the previous backup, so restoration requires the last full backup plus every incremental in sequence. Sunday's full plus Monday, Tuesday and Wednesday incrementals satisfies the stem's Wednesday failure scenario.

Before optimizing auto-scaling or adjusting capacity, the organization needs accurate data on resource usage and performance. Monitoring tools provide visibility into when and why degradation occurs, enabling informed decisions. Without this baseline, any capacity changes are guesswork. The auditor should recommend establishing monitoring first as it is foundational to effective capacity management and will inform subsequent actions.

Availability equals MTBF divided by the sum of MTBF and MTTR: 200 / (200 + 20) = 200/220 = 0.909, giving 90.9%. The 20-hour repair window is the only downtime component, so the system is available for 200 of every 220 hours.

CDP captures changes continuously or near-continuously, enabling recovery to any point in time with minimal data loss. With an RPO of 5 minutes, hourly incrementals are insufficient. CDP can achieve an RPO of seconds or minutes, meeting the requirement. This is the most appropriate recommendation because it directly addresses the gap between the current backup frequency and the required RPO.

Insufficient processing capacity at the alternate site means the workload cannot be recovered within the required window, directly explaining the missed RTO. This satisfies the stem's constraint by identifying a resource shortfall in the recovery environment rather than a procedural or documentation failure.

With only a daily manual check, a failed batch job could go unnoticed for up to 24 hours. This delay can disrupt dependent business processes, such as financial reporting or payroll, causing operational and financial impact. Automated monitoring with alerts would enable immediate detection and response. This is the most significant risk because it directly affects timeliness and availability of critical processing.

The greatest concern is the collapse of segregation of duties: one shared production operator ID performs execution, modification of job control statements, restart, and release of held jobs. Because the same credential spans all these functions, no independent review or approval can be enforced, and actions cannot be attributed to an individual. This defeats the detective and preventive controls that a batch environment depends on.

Maximum Tolerable Downtime directly expresses the longest period a critical process may remain unavailable before unacceptable business impact occurs, which is precisely the outage limit a BIA must document. Recovery Time Objectives for individual systems are then derived to sit within this business-defined threshold, satisfying the stem's requirement for the maximum acceptable outage.

RPO defines the maximum tolerable data loss, expressed as time, and directly drives backup frequency. A BIA must record it so recovery strategies align with the financial services company's tolerance for lost transactions, making it one of the three core metrics alongside RTO and MTD.

SAM maintains an accurate inventory of installed software against entitlements, so licensing compliance is the primary benefit. It directly satisfies the stem's constraint by reconciling deployed licences with purchased rights, preventing legal exposure and unbudgeted true-up costs.

This is a significant risk because without a defined escalation path, critical incidents may remain at lower support tiers, preventing senior management from being informed and making timely decisions. This can prolong outages and increase business impact. Escalation procedures ensure that the right people are engaged at the right time, especially for high-severity incidents that require executive attention or cross-functional coordination.

Because the restore succeeded but exceeded the 4-hour MTD, the recovery capability does not support the business requirement. The auditor should conclude that the recovery process needs redesign, such as using snapshot or replication technologies, faster storage, or parallel recovery, to bring restoration time within the MTD. This is the actionable control conclusion from the test.

A standard change is a pre-authorised, low-risk change with a documented procedure, requiring no further CAB approval before implementation. This directly satisfies the stem's constraints: the firewall change is low risk and pre-approved, so it follows an established path rather than requiring individual authorisation.

The BIA determines which business processes are critical and quantifies their recovery time objectives and recovery point objectives. These outputs drive the continuity strategy, so identifying critical processes and their recovery requirements is its primary purpose rather than risk ranking alone.

A formal prioritization scheme ensures that problem records are addressed according to business impact and urgency, optimizing resource allocation. Without it, problems may be handled in an ad hoc manner, delaying resolution of critical issues. This improvement complements proactive identification by ensuring that the most significant problems receive appropriate attention and escalation.

The known error database records previously diagnosed problems and their documented workarounds, letting service desk staff resolve recurring incidents quickly without re-diagnosing root cause. It is a core problem management artefact, distinct from the incident record itself.

Regression testing verifies that existing functionality still works after a change. Skipping it for minor changes allows unintended side effects to reach production undetected, directly weakening change control in a financial application where data integrity and transaction accuracy are critical.

Problem management maintains a known error database and workarounds. Without it, support staff cannot quickly reference previously identified issues and solutions, so they may spend more time diagnosing the same problems. This leads to longer resolution times and reduced service quality, making it a correct consequence.

Reciprocal agreements rely on the assumption that the partner's facility will be available and have spare capacity. However, if both organizations are affected by the same disaster (e.g., regional event), the partner may be unable to accommodate the additional load. This is a critical risk because it can render the DRP ineffective precisely when needed. The auditor should emphasize this as the most significant concern.

A warm site is partially equipped: hardware, peripherals and network connectivity are installed, but current production data is absent and must be restored from backups before operations resume. This distinguishes it from a hot site, which holds mirrored live data, and a cold site, which lacks installed equipment.

Unsupported software no longer receives vendor security patches, so known vulnerabilities remain permanently exploitable. This directly satisfies the stem's primary risk: unmitigated exposure, since no remediation path exists until the version is upgraded or replaced.

The RTO in the plan does not match the business requirement identified by clinical staff. The auditor should first recommend that the RTO be corrected to reflect the actual tolerable downtime, and then the recovery strategy must be reassessed to ensure it can meet the new RTO. Aligning the RTO with business needs is the foundation for an effective continuity plan.

A known error database captures diagnosed root causes and documented workarounds so that support staff can resolve recurrences faster and avoid duplicating diagnostic effort. It converts problem investigations into organizational knowledge. For an environment where the same faults reappear, this repository directly supports consistent handling and provides evidence that problems are being analyzed rather than merely closed, making it a core problem management activity.

A right-to-audit clause contractually grants the organisation access to assess the vendor's controls, processes and evidence. Without it, the auditor cannot independently verify the outsourced help desk's control environment, directly satisfying the stem's assessment objective.

Automated monitoring of CPU, memory, storage, and network utilization against defined thresholds generates alerts when consumption approaches capacity limits, allowing staff to act before users are affected. It is continuous, objective, and repeatable, unlike manual review. Defining thresholds converts raw metrics into actionable triggers, which is exactly the proactive detection the scenario requires for critical production systems.

Alternate facilities provide the recoverable processing environment when the primary site is unavailable, satisfying the continuity strategy's requirement for restoring critical operations within the maximum tolerable downtime. Without a prearranged site, recovery depends on ad hoc arrangements that rarely meet required timeframes.

Dual control requires two authorized individuals to approve and apply scheduling changes, preventing a single operator from unilaterally altering production processing. This directly addresses the segregation-of-duties weakness where one person can modify JCL and schedules. It is the most effective preventive control because it introduces independent verification before the change executes, reducing the risk of unauthorized or erroneous job modifications affecting financial or operational data.

Production changes to network addressing, routing or topology were not reflected in the DR documentation, so the hot site was configured against an outdated baseline. Configuration drift between production and the plan causes such incompatibility during full interruption testing.

A warm site with pre-installed hardware but no replicated data requires restoring from offsite backups, which involves retrieving media, rebuilding systems, and replaying data. This process typically exceeds six hours and may also lose up to a day of transactions. The mismatch between the recovery strategy and the RTO is the most critical issue because it directly threatens the bank's ability to resume core operations within tolerance.

A test restoration is the only procedure that directly demonstrates the backups can be read and used to rebuild data or the application. Restoring selected files or a full instance to an isolated environment and reconciling record counts or control totals validates both media readability and data integrity. This evidence-based approach also exercises the documented recovery procedures, revealing gaps in instructions or dependencies before a real outage occurs.

Release planning defines scope, schedule, dependencies and acceptance criteria before build begins, giving the release process its controlled baseline. Without this upfront activity, subsequent build, test and deployment stages lack agreed entry criteria, so the release cannot be managed or authorised against defined expectations.

This is the most significant consequence because without problem management, root causes of recurring incidents are not identified and eliminated. Workarounds only provide temporary relief, so the same incidents will recur, causing repeated disruptions, wasted effort, and potential impact on service levels. This creates a cycle of firefighting that can erode user confidence and increase operational costs. The auditor should recommend implementing a formal problem management process.

Without problem records and root cause analysis, the underlying defect remains, causing repeated outages that affect availability, customer transactions, and regulatory obligations. Each recurrence consumes support resources, incurs recovery costs, and may breach service level agreements. This is the most significant risk because it directly threatens business operations and resilience, which is the core concern of the audit finding.