CCNA Contingency Management Questions

MCQmedium

Your organization uses a 'Warm Site' for its disaster recovery strategy. During a recent audit, you find that the site lacks the necessary bandwidth to support peak production traffic. What is the most appropriate management response?

A.Cancel the warm site contract and build a cold site.

B.Require all employees to work from home during a disaster to save bandwidth.

C.Accept the risk formally via the Risk Register without further mitigation.

D.Update the DRP to include a 'throttling' policy for non-critical services during failover.

AnswerD

Managing capacity through service degradation is a legitimate risk mitigation strategy when infrastructure is limited.

Why this answer

A warm site must be periodically validated against current production loads to ensure the SLA can be met.

Practice this question →

MCQmedium

You are auditing a third-party disaster recovery service provider. Which metric provides the most accurate evidence that the provider can meet your organization's required recovery point for a database cluster?

A.Mean Time to Recovery (MTTR) reports from previous tests.

B.Service Level Agreement (SLA) uptime percentages.

C.Replication Lag monitoring logs showing synchronization latency.

D.Annual penetration test results.

AnswerC

Replication lag directly indicates the age of the data at the secondary site, which is the definition of RPO.

Why this answer

RPO is defined by data loss tolerance, which is best measured by the age of the last successful backup or replication point.

Practice this question →

Multi-Selecthard

Which THREE of the following strategies should be included in a 'Disaster Recovery Program Oversight' function to ensure long-term viability?

Select 3 answers

A.Annual validation of the BIA to ensure it reflects current business priorities.

B.Mandating the use of specific hardware vendors for all offices.

C.Standardization of server naming conventions across all data centers.

D.Conducting regular, risk-based testing of the recovery plans.

E.Periodic review and updating of the DRP based on infrastructure changes.

AnswersA, D, E

Business priorities shift; the BIA must be validated to keep DR efforts focused.

Why this answer

Oversight involves continuous validation through testing, alignment with changing business goals, and periodic audits of the documentation.

Practice this question →

MCQhard

Your organization has decided to use a 'Cloud Disaster Recovery' service. The vendor provides a 'Pilot Light' strategy. What does this mean for your organization's recovery capability?

A.A complete replica of the production environment is running 24/7.

B.Core services are running, and the remaining infrastructure can be scaled up on demand.

C.The environment only exists as data snapshots in cold storage.

D.The environment is hosted on-premises and fails over to a secondary data center.

AnswerB

This is the definition of a pilot light approach, balancing cost and speed.

Why this answer

A pilot light maintains critical core components (e.g., database) in a running state, while application tiers are spun up on-demand during a disaster.

Practice this question →

MCQeasy

When designing the Crisis Communication Plan, why is it essential to establish pre-approved communication templates?

A.To allow marketing teams to create brand-focused content.

B.To bypass legal review during the crisis.

C.To ensure consistent and rapid messaging during high-stress situations.

D.To fulfill regulatory requirements for daily status reports.

AnswerC

Pre-approved templates minimize time spent drafting messages and reduce the likelihood of inconsistent communication.

Why this answer

During a crisis, speed and accuracy are critical. Templates reduce cognitive load and prevent errors in messaging.

Practice this question →

MCQmedium

You are implementing a disaster recovery strategy for a database that uses synchronous replication. What is the most significant trade-off you must accept by enforcing this configuration?

A.Increased latency for write operations.

B.Higher risk of data corruption.

C.Increased probability of backup failure.

D.Limited scalability of the database cluster.

AnswerA

Synchronous replication mandates that the primary site waits for confirmation from the secondary, increasing write latency.

Why this answer

Synchronous replication guarantees zero data loss (RPO=0) but introduces latency overhead on write operations because the commit must wait for the acknowledgment from the secondary site.

Practice this question →

Multi-Selectmedium

Which TWO of the following are primary risks associated with an 'asynchronous' data replication strategy?

Select 2 answers

A.Excessive consumption of bandwidth during peak hours.

B.Total system failure due to incompatible storage protocols.

C.The RPO will always be greater than zero.

D.Potential for data divergence (data loss) in the event of a failover.

E.Increased network latency on the primary application.

AnswersC, D

Because there is a lag, some data loss is inevitable if the primary site fails suddenly.

Why this answer

Asynchronous replication introduces a lag, meaning if the primary fails, the latest data might not have reached the secondary, risking data loss.

Practice this question →

MCQeasy

Which document serves as the primary governing authority to define the triggers, escalation paths, and communication roles during a declared crisis event?

A.Business Impact Analysis (BIA)

B.Crisis Management Plan (CMP)

C.Standard Operating Procedure (SOP)

D.Disaster Recovery Plan (DRP)

AnswerB

The CMP specifically addresses leadership, communication, and decision-making during crisis events.

Why this answer

The Crisis Management Plan provides the governance for decision-making during a crisis, whereas the DRP focuses on technical restoration.

Practice this question →

MCQhard

During a disaster recovery simulation for a hybrid cloud environment, you discover that the automated orchestration tool fails to restore dependencies in the correct order because the cloud provider's metadata tags were purged. What is the most effective administrative control to prevent this during a real event?

A.Enforce mandatory tagging policies using AWS Service Control Policies (SCPs) or Azure Policy.

B.Increase the RTO buffer time in the Service Level Agreement (SLA).

C.Switch from automated restoration to manual snapshot-based restores.

D.Implement a manual verification step in the Disaster Recovery Plan (DRP) documentation.

AnswerA

Policy-based enforcement ensures metadata persistence required for automated recovery orchestration.

Why this answer

Maintaining configuration drift control and metadata persistence through Infrastructure as Code (IaC) is essential for automated recovery.

Practice this question →

MCQmedium

When classifying business processes for BCP, what is the 'Recovery Time Objective' (RTO) most effectively used for?

A.Identifying the critical staff needed for recovery.

B.Determining the technology and infrastructure requirements for restoration.

C.Assessing the data loss tolerance.

D.Calculating the financial impact of the event.

AnswerB

RTO drives the technical design (e.g., hot vs. cold site) to meet the business window.

Why this answer

RTO informs the investment and technology choices for the recovery strategy to ensure service restoration occurs within the business-defined window.

Practice this question →

MCQhard

Your organization has adopted a cloud-native microservices architecture. Which strategy is most appropriate for maintaining business continuity in the event of a regional cloud provider outage?

A.Multi-region active-active deployment with global load balancing.

B.Cross-region cold standby snapshots.

C.On-premises hot-site failover.

D.Single-region immutable backups.

AnswerA

This architecture ensures that if one region goes down, traffic is automatically routed to another.

Why this answer

Multi-region deployment with active-active traffic distribution provides the highest level of resilience for cloud-native apps.

Practice this question →

Multi-Selectmedium

An ISSMP is reviewing the Business Continuity Plan (BCP) for a critical application. Which TWO of the following factors should be considered when defining the 'Maximum Tolerable Downtime' (MTD)?

Select 2 answers

A.Legal and regulatory compliance requirements.

B.Total expected cost of hardware replacement.

C.The organization's financial tolerance for revenue loss.

D.The current availability of spare parts in the data center.

E.The number of employees required to perform manual workarounds.

AnswersA, C

Regulators often impose strict timeframes for service availability.

Why this answer

MTD is defined by financial and operational thresholds, often dictated by contractual obligations or total loss of revenue potential.

Practice this question →

MCQeasy

What is the primary objective of a 'lessons learned' meeting conducted after a disaster recovery exercise?

A.Identify gaps in the plan and define remediation actions.

B.Update the organizational chart.

C.Verify the status of the offsite backup tapes.

D.Evaluate the performance of the IT staff for disciplinary purposes.

AnswerA

The primary goal is the continuous improvement of the plan based on identified weaknesses.

Why this answer

The objective is to identify gaps in the plan based on the exercise results and assign ownership for remediation.

Practice this question →

MCQhard

Your organization uses a 'Hot Site' with hardware-level replication. During a disaster, the primary site becomes unavailable, but the failover fails due to a 'Split-Brain' scenario. What is the fundamental cause of this?

A.Mismatched firmware versions between servers.

B.Inadequate storage capacity for incoming logs.

C.Loss of the heartbeat connection/quorum service.

D.Insufficient cooling at the hot site.

AnswerC

Without a heartbeat or quorum, both nodes may independently assume they are the master, causing data divergence.

Why this answer

Split-brain happens when both sites think they are the primary due to loss of the quorum or heartbeat mechanism.

Practice this question →

MCQmedium

An ISSMP is revising the BCP to account for 'Supply Chain Resiliency'. Which approach is best for verifying that critical third-party vendors can meet the organization's recovery requirements?

A.Reviewing vendor-provided Disaster Recovery test reports and performance metrics.

B.Sending a self-assessment questionnaire to the vendor.

C.Performing an independent penetration test on the vendor's network.

D.Requiring vendors to sign an updated Service Level Agreement.

AnswerA

Reviewing evidence of actual tests provides the best assurance of vendor capability.

Why this answer

Contractual RTO/RPO requirements must be validated via audit or simulation results.

Practice this question →

Multi-Selecthard

Which THREE of the following are essential components of a robust Crisis Management Plan?

Select 3 answers

A.Clearly defined crisis team roles and responsibilities.

B.Procedures for activating the crisis management team.

C.An inventory of all software licenses held by the organization.

D.Pre-determined communication protocols for external stakeholders.

E.Granular technical steps for server restoration.

AnswersA, B, D

Everyone must know who has the authority to make critical decisions.

Why this answer

Crisis management requires clear authority, defined communication channels, and a pre-identified team with specific roles.

Practice this question →

MCQeasy

Which of the following is the most effective method for testing the efficacy of a Business Continuity Plan without disrupting production operations?

A.Parallel processing test.

B.Cutover test.

C.Full-scale simulation.

D.Tabletop exercise.

AnswerD

Tabletop exercises are designed to test decision-making and logic without requiring downtime.

Why this answer

A tabletop exercise is a discussion-based simulation that tests plan logic and communication without affecting production systems.

Practice this question →

Multi-Selecthard

When designing a Disaster Recovery Program, which THREE of the following represent common 'single points of failure' that must be addressed?

Select 3 answers

A.Key-person dependency for initiating the disaster declaration.

B.Dependence on a single, non-redundant telecommunications provider for data replication.

C.Reliance on a single physical location for primary and backup storage.

D.Use of standardized enterprise resource planning software.

E.The use of automated server patching tools.

AnswersA, B, C

If only one person can declare a disaster, the process fails if that person is incapacitated.

Why this answer

Resilience requires removing dependencies on single, irreplaceable entities (people, physical locations, or specific gateway devices).

Practice this question →

MCQmedium

In a decentralized organization, which approach to BCP management ensures both local agility and global alignment?

A.Leaving BCP entirely to the discretion of local department managers.

B.A strictly centralized command-and-control model.

C.Outsourcing the entire BCP function to a single managed service provider.

D.A federated model with a centralized governance framework.

AnswerD

This provides the balance of local flexibility and enterprise-wide compliance.

Why this answer

A federated model allows individual business units to customize plans to their specific needs while adhering to a common global framework/policy.

Practice this question →

Multi-Selectmedium

During a BIA review, you need to identify critical assets and their recovery requirements. Which TWO of the following inputs are essential for this classification process?

Select 2 answers

A.Current data center power consumption logs.

B.Interviews with business process owners.

C.Technical dependency mapping of applications to infrastructure.

D.The organization's current IT procurement strategy.

E.Employee performance review records.

AnswersB, C

Business owners identify which processes are critical to business survival.

Why this answer

The BIA requires both understanding of the process importance and the technical dependencies (what systems are actually used).

Practice this question →

Multi-Selectmedium

Which TWO of the following are effective ways to improve 'Crisis Management Leadership' effectiveness during an incident?

Select 2 answers

A.Ensuring a dedicated communications officer manages stakeholder messaging.

B.Removing all documentation to force teams to think creatively.

C.Ignoring external media requests to focus only on technical repair.

D.Establishing a clear chain of command for incident authority.

E.Requiring all employees to attend weekly disaster drills.

AnswersA, D

Having a single point of truth for communication prevents misinformation.

Why this answer

Leadership requires clear delegation and effective, structured communication to prevent panic and ensure well-informed decisions.

Practice this question →

MCQmedium

During a BCP planning session, the executive team is debating the 'Maximum Tolerable Downtime' (MTD) for a legacy internal application. What is the correct way to define this metric?

A.The maximum acceptable age of data in the event of a system crash.

B.The time taken to fail over to the secondary site during a disaster.

C.The time required to restore the application from the latest tape backup.

D.The total duration of time that an organization can tolerate a business process being unavailable.

AnswerD

MTD represents the upper limit of downtime tolerance before irreversible business impact occurs.

Why this answer

MTD is the total time a process can be down before the organization suffers catastrophic/irreversible harm.

Practice this question →

MCQmedium

An ISSMP is overseeing a BCP program and notes that the current Business Impact Analysis (BIA) is heavily focused on RTO but lacks a critical dependency mapping for cross-functional business processes. Which specific action should the ISSMP prioritize to address the systemic risk of cascading failure during a disaster?

A.Implement a redundant secondary site for all identified Tier 1 applications.

B.Update the BIA to include qualitative impact assessments for all business units.

C.Initiate a value chain analysis using the SCOR model to identify inter-process dependencies.

D.Mandate an immediate increase in the frequency of full-scale BCP simulation exercises.

AnswerC

The Supply Chain Operations Reference (SCOR) model is effective for mapping internal process dependencies.

Why this answer

BIA must move beyond simple RTO/RPO metrics to identify upstream and downstream process dependencies to ensure that recovery orchestration remains viable.

Practice this question →

MCQhard

Following a ransomware attack, the organization must decide whether to invoke the DRP or remain in a degraded state while security teams perform forensics. What is the ISSMP's primary responsibility in this decision-making process?

A.Choosing the restore point from the offsite immutable backup.

B.Ensuring the decision is documented to align with the organization's risk appetite.

C.Performing the initial forensic image of the infected servers.

D.Directing the IT team to disconnect the network immediately.

AnswerB

The ISSMP acts as an advisor to ensure the chosen path reflects the established risk appetite.

Why this answer

The ISSMP must facilitate the risk-based decision between recovery speed (DRP) and evidence preservation (Forensics).

Practice this question →