ISC2 CC Business Continuity, DR & Incident Response Practice Question
During a tabletop exercise, the IT team realizes that the backup tapes are stored in the same building as the servers. Which risk does this highlight?
⚠ Common exam trap
ISC2 often tests the distinction between 'lack of redundancy' (duplicate hardware) and 'insufficient off-site storage' (geographic separation of backups), trapping candidates who confuse high-availability concepts with disaster recovery requirements.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Insufficient off-site storage
Storing backup tapes in the same building as the primary servers violates the fundamental principle of geographic separation for disaster recovery. If a fire, flood, or physical security breach destroys the building, both the primary data and the backup tapes are lost simultaneously, rendering the backups useless. This directly indicates a lack of off-site storage, which is a core requirement for a viable backup strategy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Insufficient off-site storage
Why this is correct
Storing tapes in the same building as the servers creates a single point of failure: any incident destroying the site, such as fire or flood, would destroy both production data and its backups. This directly violates the off-site storage requirement, since no geographically separate copy survives to enable recovery.
- ✗
Single point of failure
Why it's wrong here
Storing tapes beside servers creates a common failure domain, so one fire, flood or theft destroys both live data and its backups. Single point of failure describes a component with no alternate path, such as one power supply or one link, not co-located copies of the same data.
- ✗
Lack of redundancy
Why it's wrong here
Redundancy concerns duplicate components, whereas the flaw here is a shared physical location. Two copies exist, so redundancy is present; what fails is geographic separation. Lack of redundancy would be the answer if only one backup copy existed at all.
- ✗
Inadequate segregation of duties
Why it's wrong here
Segregation of duties concerns splitting conflicting tasks between different people, such as backup creation versus restoration approval. The stem describes physical storage placement, not who performs which task, so this control is unrelated to the co-location exposure.
Go deeper
Related to this question
Learn chapter
Risk Management and Security Controls
Key term
Disaster recovery
Disaster recovery is a set of policies, procedures, and tools that help an organization restore critical IT systems and data after a disruptive event.
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
About these practice questions
Courseiva writes every CC question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.