The answer is that the disaster recovery plan did not include role-based access for failover operations. This is correct because the scenario describes a fully replicated standby database that cannot be promoted solely due to missing privileges, which points directly to a failure in defining role-based access control (RBAC) and assigning specific failover permissions within the plan. On the ISC2 Certified in Cybersecurity CC exam, this tests your understanding that a disaster recovery plan must go beyond technical replication and explicitly document who has the authority to execute critical recovery actions, such as promoting a standby cluster. A common trap is assuming that data replication alone ensures recovery, but without documented RBAC for failover operations, the plan has a critical gap. Memory tip: think of it as “replication without permission is just a mirror you cannot touch.”
ISC2 CC Business Continuity, DR & Incident Response Practice Question
This CC practice question tests your understanding of business continuity, dr & incident response. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
During a tabletop exercise for a data center outage, the IT manager realizes that the disaster recovery plan does not specify how to failover the database cluster. The primary data center fails completely. The standby site has a replica of the database, but the application team cannot promote it because they lack the necessary privileges. What is the most likely cause of this gap?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Clue: "primary"
Why it matters: Asks for the main purpose or function, not a secondary benefit. Eliminate answers that describe side-effects or partial functions.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The DR plan did not include role-based access for failover operations
The correct answer is D because the scenario explicitly states that the application team lacks the necessary privileges to promote the standby database. This indicates that the disaster recovery plan did not define role-based access controls (RBAC) or assign failover permissions to specific personnel or groups. Without documented roles and privileges, even a fully replicated standby database cannot be promoted, causing a failover gap.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
The standby site's network connectivity was not tested
Why it's wrong here
Network connectivity is not mentioned as an issue; the problem is access privileges.
✗
The database replication configuration was incorrect
Why it's wrong here
The replica exists, implying replication was functioning; the issue is inability to promote it.
✗
The database failover procedure was not documented
Why it's wrong here
The plan might have documentation, but the core issue is that the team lacks the necessary privileges to execute it.
✓
The DR plan did not include role-based access for failover operations
Why this is correct
Proper DR planning should define who has the authority to perform failover and ensure credentials are available at the standby site.
Clue confirmation
The clue words "most likely", "primary" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
ISC2 often tests the distinction between a missing procedure (documentation gap) and missing authorization (access control gap), leading candidates to pick 'procedure not documented' when the real issue is that the team lacks the privileges to execute any procedure.
Detailed technical explanation
How to think about this question
In database clustering (e.g., SQL Server Always On Availability Groups or Oracle Data Guard), promoting a standby to primary typically requires specific roles like 'sysadmin' or 'SYSDBA' and often involves executing commands like `ALTER AVAILABILITY GROUP <name> FAILOVER` or `ALTER DATABASE RECOVER MANAGED STANDBY DATABASE FINISH`. Without these privileges pre-assigned in the DR plan, the failover operation fails even if the data is fully synchronized. Real-world DR plans must include a privilege matrix that maps failover actions to specific user accounts or service principals, often integrated with Active Directory or IAM roles.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security analyst at a medium-sized enterprise encounters this scenario during an investigation or architecture review. The correct answer reflects best practice for the specific threat or control described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Security exam questions test whether you can match controls to threats in context — not just recall definitions.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this CC question in full detail.
Business Continuity, DR & Incident Response — This question tests Business Continuity, DR & Incident Response — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: The DR plan did not include role-based access for failover operations — The correct answer is D because the scenario explicitly states that the application team lacks the necessary privileges to promote the standby database. This indicates that the disaster recovery plan did not define role-based access controls (RBAC) or assign failover permissions to specific personnel or groups. Without documented roles and privileges, even a fully replicated standby database cannot be promoted, causing a failover gap.
What should I do if I get this CC question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "most likely", "primary". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.