How should I use these Business Continuity, DR & Incident Response practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

CC · topic practice

Business Continuity, DR & Incident Response practice questions

Q: Can I practise just Business Continuity, DR & Incident Response questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Business Continuity, DR & Incident Response domain.

Practise ISC2 Certified in Cybersecurity CC Business Continuity, DR & Incident Response practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Business Continuity, DR & Incident Response

Practice 10 questions Browse domain →

What the exam tests

What to know about Business Continuity, DR & Incident Response

Business Continuity, DR & Incident Response questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Business Continuity, DR & Incident Response exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Business Continuity, DR & Incident Response questions

20 questions · select your answer, then reveal the explanation

Question 1easymultiple choice

Read the full Business Continuity, DR & Incident Response explanation →

During a ransomware incident, the incident response team isolates affected systems. Which of the following is the NEXT best step?

Trap 1: Wipe and rebuild all affected systems.

Wiping destroys forensic evidence needed for investigation.

Trap 2: Notify law enforcement immediately.

Notification should occur after evidence collection and internal escalation.

Trap 3: Pay the ransom to restore operations quickly.

Paying ransom encourages attackers and does not guarantee recovery.

Study all Business Continuity, DR & Incident Response common traps →

A
Preserve forensic evidence from the isolated systems.
Preserving evidence supports investigation and potential legal action.
B
Wipe and rebuild all affected systems.
Why wrong: Wiping destroys forensic evidence needed for investigation.
C
Notify law enforcement immediately.
Why wrong: Notification should occur after evidence collection and internal escalation.
D
Pay the ransom to restore operations quickly.
Why wrong: Paying ransom encourages attackers and does not guarantee recovery.

Full breakdown with real-world context →

Question 2mediummultiple choice

Read the full Business Continuity, DR & Incident Response explanation →

An organization's recovery time objective (RTO) for its customer database is 4 hours. During a disaster, the backup restore process takes 2 hours, but reconfigure and test tasks add another 3 hours. Which action best addresses this gap?

Trap 1: Conduct the restore test only during annual disaster recovery…

Infrequent testing does not resolve the time gap.

Trap 2: Reduce the recovery point objective (RPO) to minimize data loss.

RPO addresses data loss, not recovery time.

Trap 3: Increase the RTO to 6 hours.

RTO should be driven by business needs, not adjusted to match capability.

Study all Business Continuity, DR & Incident Response common traps →

A
Conduct the restore test only during annual disaster recovery drills.
Why wrong: Infrequent testing does not resolve the time gap.
B
Reduce the recovery point objective (RPO) to minimize data loss.
Why wrong: RPO addresses data loss, not recovery time.
C
Increase the RTO to 6 hours.
Why wrong: RTO should be driven by business needs, not adjusted to match capability.
D
Automate the configuration and validation steps after restore.
Automation reduces manual time, helping meet the 4-hour RTO.

Full breakdown with real-world context →

Question 3hardmultiple choice

Read the full Business Continuity, DR & Incident Response explanation →

A SOC analyst receives an alert indicating a user executed a PowerShell script that initiated outbound connections to an external IP. The script was delivered via email attachment. Which incident response phase is MOST appropriate for containing this threat?

Trap 1: Identification phase

Identification is about detecting and analyzing, not containing.

Trap 2: Recovery phase

Recovery occurs after threats are contained and eradicated.

Trap 3: Preparation phase

Preparation occurs before incidents happen.

Study all Business Continuity, DR & Incident Response common traps →

A
Identification phase
Why wrong: Identification is about detecting and analyzing, not containing.
B
Eradication phase
Eradication includes containment actions like blocking IPs and removing malware.
C
Recovery phase
Why wrong: Recovery occurs after threats are contained and eradicated.
D
Preparation phase
Why wrong: Preparation occurs before incidents happen.

Full breakdown with real-world context →

Question 4easymultiple choice

Read the full NAT/PAT explanation →

A company's business continuity plan includes an alternate work site with full IT capabilities. Which type of recovery site does this describe?

Trap 1: Mobile site

A mobile site is a portable unit, not necessarily fully equipped.

Trap 2: Cold site

A cold site has no equipment; it is just a physical space.

Trap 3: Warm site

A warm site has some equipment but not fully configured.

Study all Business Continuity, DR & Incident Response common traps →

A
Hot site
A hot site is fully operational with all necessary hardware, software, and data.
B
Mobile site
Why wrong: A mobile site is a portable unit, not necessarily fully equipped.
C
Cold site
Why wrong: A cold site has no equipment; it is just a physical space.
D
Warm site
Why wrong: A warm site has some equipment but not fully configured.

Full breakdown with real-world context →

Question 5mediummultiple choice

Read the full Business Continuity, DR & Incident Response explanation →

An organization uses a primary data center and a backup site 500 miles away. The backup site replicates data synchronously. Which risk is MOST likely introduced by this configuration?

Trap 1: High recovery point objective (RPO)

Synchronous replication yields low RPO, not high.

Trap 2: Data encryption overhead

Encryption may add processing delay but is not the primary risk from distance.

Trap 3: Insufficient bandwidth between sites

Bandwidth affects throughput but not necessarily latency.

Study all Business Continuity, DR & Incident Response common traps →

A
High recovery point objective (RPO)
Why wrong: Synchronous replication yields low RPO, not high.
B
Data encryption overhead
Why wrong: Encryption may add processing delay but is not the primary risk from distance.
C
Insufficient bandwidth between sites
Why wrong: Bandwidth affects throughput but not necessarily latency.
D
Increased latency for write operations
Synchronous replication requires acknowledgment from backup, causing latency proportional to distance.

Full breakdown with real-world context →

Question 6hardmulti select

Read the full Business Continuity, DR & Incident Response explanation →

Which TWO actions are appropriate during the identification phase of incident response?

Trap 1: Conduct a post-mortem analysis.

Post-mortem occurs after incident resolution.

Trap 2: Restore data from backups.

Restoration is part of recovery phase.

Trap 3: Disconnect affected systems from the network.

This is a containment action, not identification.

Study all Business Continuity, DR & Incident Response common traps →

A
Conduct a post-mortem analysis.
Why wrong: Post-mortem occurs after incident resolution.
B
Correlate alerts from multiple sources.
Alert correlation aids in identifying incidents.
C
Review system logs for anomalies.
Log review helps identify potential incidents.
D
Restore data from backups.
Why wrong: Restoration is part of recovery phase.
E
Disconnect affected systems from the network.
Why wrong: This is a containment action, not identification.

Full breakdown with real-world context →

Question 7mediummulti select

Read the full Business Continuity, DR & Incident Response explanation →

Which THREE elements are essential components of a business continuity plan (BCP)?

Trap 1: Incident response team roster

Part of incident response plan, not necessarily BCP.

Trap 2: Detailed network topology diagrams

While helpful, they are more technical and not always essential in a BCP.

Study all Business Continuity, DR & Incident Response common traps →

A
Data backup schedules and procedures
Backup procedures ensure data availability.
B
Business impact analysis (BIA) results
BIA informs recovery priorities and RTO/RPO.
C
Incident response team roster
Why wrong: Part of incident response plan, not necessarily BCP.
D
Emergency contact lists
Contact lists are critical for communication during a disruption.
E
Detailed network topology diagrams
Why wrong: While helpful, they are more technical and not always essential in a BCP.

Full breakdown with real-world context →

Question 8easymultiple choice

Read the full Business Continuity, DR & Incident Response explanation →

Based on the incident log, at which step did the incident response team contain the threat?

Exhibit

Refer to the exhibit.

---
Incident #1023 - Malware Infection
Detection: Antivirus alert on workstation WKS-045
Time: 2024-03-15 14:22 UTC
Actions:
  14:25 - Isolated WKS-045 from network
  14:30 - Scanned system, detected Trojan.Downloader
  14:35 - Escalated to incident handler
  14:45 - Removed malware via AV
  15:00 - System back online
---

Trap 1: 14:30 - Scanned system, detected Trojan.Downloader

Scanning is part of identification/analysis, not containment.

Trap 2: 14:45 - Removed malware via AV

Removal is eradication, which follows containment.

Trap 3: 14:35 - Escalated to incident handler

Escalation is communication, not containment.

Study all Business Continuity, DR & Incident Response common traps →

A
14:30 - Scanned system, detected Trojan.Downloader
Why wrong: Scanning is part of identification/analysis, not containment.
B
14:45 - Removed malware via AV
Why wrong: Removal is eradication, which follows containment.
C
14:25 - Isolated WKS-045 from network
Isolation prevents further spread, containing the threat.
D
14:35 - Escalated to incident handler
Why wrong: Escalation is communication, not containment.

Full breakdown with real-world context →

Question 9mediummultiple choice

Read the full Business Continuity, DR & Incident Response explanation →

Based on the backup schedule, what is the maximum potential data loss?

Exhibit

Refer to the exhibit.

---
Backup Configuration (extract):
- Full backup: Every Sunday at 01:00
- Differential backup: Monday-Saturday at 01:00
- Retention: 30 days
---
A server fails on Wednesday at 10:00. The administrator restores from the most recent full backup and applies the latest differential backup. How much data loss is expected?

Trap 1: 9 hours (since Tuesday 01:00)

9 hours would be if failure at 10:00 on Tuesday, not Wednesday.

Trap 2: 2 days (data since Monday)

Differential on Tuesday includes Monday's data; loss starts from Tuesday 01:00.

Trap 3: 1 day (data since last full backup)

Full backup was Sunday; differential on Tuesday captures changes up to Tuesday 01:00.

Study all Business Continuity, DR & Incident Response common traps →

A
9 hours (since Tuesday 01:00)
Why wrong: 9 hours would be if failure at 10:00 on Tuesday, not Wednesday.
B
2 days (data since Monday)
Why wrong: Differential on Tuesday includes Monday's data; loss starts from Tuesday 01:00.
C
33 hours (data since Tuesday 01:00)
Last successful backup was Tuesday 01:00; failure at Wednesday 10:00 = 33 hours.
D
1 day (data since last full backup)
Why wrong: Full backup was Sunday; differential on Tuesday captures changes up to Tuesday 01:00.

Full breakdown with real-world context →

Question 10hardmultiple choice

Read the full NAT/PAT explanation →

You are the incident response lead for a financial services company. At 09:00, the SOC detects unusual outbound traffic from a server in the DMZ to an external IP known to be a command-and-control (C2) server. The server runs a legacy application that cannot be patched. The server is critical for customer transactions, but an alternate manual process can sustain operations for up to 4 hours. The CTO wants to keep the server online to avoid customer impact. The CEO is concerned about data exfiltration. The compliance officer reminds you of regulatory requirements to report breaches within 72 hours. Which action should you take FIRST?

Trap 1: Report the incident to the regulatory authority immediately.

Reporting is important but not the first action; containment takes precedence.

Trap 2: Perform a forensic analysis of the server to determine the scope of…

Analysis should follow containment to prevent ongoing damage.

Trap 3: Keep the server online under close monitoring to minimize customer…

Continued operation risks data exfiltration and further compromise.

Study all Business Continuity, DR & Incident Response common traps →

A
Report the incident to the regulatory authority immediately.
Why wrong: Reporting is important but not the first action; containment takes precedence.
B
Perform a forensic analysis of the server to determine the scope of compromise.
Why wrong: Analysis should follow containment to prevent ongoing damage.
C
Disconnect the server from the network and activate the manual process.
Immediate containment stops the C2 communication and protects data.
D
Keep the server online under close monitoring to minimize customer disruption.
Why wrong: Continued operation risks data exfiltration and further compromise.

Full breakdown with real-world context →

Question 11mediummultiple choice

Read the full Business Continuity, DR & Incident Response explanation →

An organization experiences a ransomware attack that encrypts critical file servers. The backups are stored on a separate network segment but are also encrypted. The incident response team suspects the attacker compromised the backup system using stored credentials. Which best practice should have been implemented to prevent this?

Trap 1: Implement air-gapped backups stored offline

Air-gapped backups would prevent online encryption, but the scenario specifically mentions stored credentials were used; air-gapping does not address credential compromise directly.

Trap 2: Encrypt backup data at rest and in transit

Encryption protects data confidentiality but does not prevent an attacker from deleting or encrypting backups if they gain access.

Trap 3: Use a separate VLAN for backup traffic

Network segmentation alone does not prevent an attacker who has already gained access to the backup system via stolen credentials.

Study all Business Continuity, DR & Incident Response common traps →

A
Implement air-gapped backups stored offline
Why wrong: Air-gapped backups would prevent online encryption, but the scenario specifically mentions stored credentials were used; air-gapping does not address credential compromise directly.
B
Enable multi-factor authentication (MFA) on backup system access
MFA mitigates the risk of credential theft, as the attacker would need an additional factor to authenticate.
C
Encrypt backup data at rest and in transit
Why wrong: Encryption protects data confidentiality but does not prevent an attacker from deleting or encrypting backups if they gain access.
D
Use a separate VLAN for backup traffic
Why wrong: Network segmentation alone does not prevent an attacker who has already gained access to the backup system via stolen credentials.

Full breakdown with real-world context →

Question 12hardmultiple choice

Read the full Business Continuity, DR & Incident Response explanation →

During a tabletop exercise for a data center outage, the IT manager realizes that the disaster recovery plan does not specify how to failover the database cluster. The primary data center fails completely. The standby site has a replica of the database, but the application team cannot promote it because they lack the necessary privileges. What is the most likely cause of this gap?

Trap 1: The standby site's network connectivity was not tested

Network connectivity is not mentioned as an issue; the problem is access privileges.

Trap 2: The database replication configuration was incorrect

The replica exists, implying replication was functioning; the issue is inability to promote it.

Trap 3: The database failover procedure was not documented

The plan might have documentation, but the core issue is that the team lacks the necessary privileges to execute it.

Study all Business Continuity, DR & Incident Response common traps →

A
The standby site's network connectivity was not tested
Why wrong: Network connectivity is not mentioned as an issue; the problem is access privileges.
B
The database replication configuration was incorrect
Why wrong: The replica exists, implying replication was functioning; the issue is inability to promote it.
C
The database failover procedure was not documented
Why wrong: The plan might have documentation, but the core issue is that the team lacks the necessary privileges to execute it.
D
The DR plan did not include role-based access for failover operations
Proper DR planning should define who has the authority to perform failover and ensure credentials are available at the standby site.

Full breakdown with real-world context →

Question 13mediummulti select

Read the full Business Continuity, DR & Incident Response explanation →

Which TWO actions are most effective in reducing the mean time to detect (MTTD) a security incident?

Trap 1: Requiring multi-factor authentication for all remote access

MFA is a preventive control, not a detective control.

Trap 2: Conducting annual security awareness training for all employees

Annual training helps prevent incidents but does not significantly reduce detection time.

Trap 3: Standardizing firewall rules across all network segments

Standardization improves security posture but does not directly impact detection speed.

Study all Business Continuity, DR & Incident Response common traps →

A
Requiring multi-factor authentication for all remote access
Why wrong: MFA is a preventive control, not a detective control.
B
Implementing a SIEM with centralized logging from critical systems
SIEM correlates events and alerts analysts, reducing detection time.
C
Conducting annual security awareness training for all employees
Why wrong: Annual training helps prevent incidents but does not significantly reduce detection time.
D
Deploying endpoint detection and response (EDR) agents on all workstations
EDR provides real-time monitoring and alerts on suspicious activity, reducing MTTD.
E
Standardizing firewall rules across all network segments
Why wrong: Standardization improves security posture but does not directly impact detection speed.

Full breakdown with real-world context →

Question 14hardmultiple choice

Read the full network assurance explanation →

The exhibit shows a syslog-ng client configuration and a firewall rule on the central logging server (IP 10.0.0.10). The client (192.168.1.100) is not sending logs to the server. What is the most likely cause?

Exhibit

Refer to the exhibit.

syslog-ng configuration:
@version: 3.35
destination d_remote { syslog("10.0.0.10" transport("tls") port(6514)); };
log { source(s_sys); destination(d_remote); };

Firewall rule on logging server:
permit tcp host 10.0.0.10 eq 6514 host 192.168.1.100

Trap 1: The syslog-ng configuration uses TLS, but the firewall rule does…

TLS over TCP is still TCP; the firewall rule permits TCP, so TLS is allowed.

Trap 2: The syslog-ng client uses UDP by default, but the firewall allows…

The client configuration explicitly uses TCP transport (tls).

Trap 3: The firewall rule does not include the client IP 192.168.1.100

The rule includes the host 192.168.1.100 as the destination, which is correct for server receiving logs.

Study all Business Continuity, DR & Incident Response common traps →

A
The syslog-ng configuration uses TLS, but the firewall rule does not allow TLS traffic
Why wrong: TLS over TCP is still TCP; the firewall rule permits TCP, so TLS is allowed.
B
The firewall rule restricts source port 6514, but the client uses a random ephemeral source port
The rule includes 'eq 6514' which matches only if source port is 6514; clients use dynamic ports.
C
The syslog-ng client uses UDP by default, but the firewall allows only TCP
Why wrong: The client configuration explicitly uses TCP transport (tls).
D
The firewall rule does not include the client IP 192.168.1.100
Why wrong: The rule includes the host 192.168.1.100 as the destination, which is correct for server receiving logs.

Full breakdown with real-world context →

Question 15easymultiple choice

Read the full DNS explanation →

A mid-sized e-commerce company has a primary data center in New York and a disaster recovery site in Dallas. The application stack includes a web server, application server, and a PostgreSQL database. The database uses synchronous replication to the DR site. During a routine failover test, the IT team discovers that after failing over to Dallas, the web servers in New York continue to attempt connections to the original database IP, causing application errors. The DNS records have been updated to point to the DR database IP, but the web servers are not refreshing their DNS cache. The company uses a standard TTL of 300 seconds. The IT manager needs a solution that ensures minimal disruption during future failovers. Which action should be taken?

Trap 1: Add a static host entry in the web servers' hosts file pointing to…

Static entries require manual updates during failover, which is not scalable and prone to errors.

Trap 2: Increase the DNS TTL to 86400 seconds to ensure all caches are…

Increasing TTL would cause caches to hold stale records longer, making the problem worse.

Trap 3: Configure the web servers to use a different DNS resolver that does…

Changing DNS resolvers does not eliminate caching; most resolvers still cache.

Study all Business Continuity, DR & Incident Response common traps →

A
Add a static host entry in the web servers' hosts file pointing to the DR database IP
Why wrong: Static entries require manual updates during failover, which is not scalable and prone to errors.
B
Increase the DNS TTL to 86400 seconds to ensure all caches are updated quickly
Why wrong: Increasing TTL would cause caches to hold stale records longer, making the problem worse.
C
Configure the web servers to use a different DNS resolver that does not cache
Why wrong: Changing DNS resolvers does not eliminate caching; most resolvers still cache.
D
Implement a load balancer or proxy with a virtual IP that can be switched during failover, and update the web server configuration to connect to the virtual IP
A virtual IP (VIP) can be moved between data centers via BGP or similar, so web servers always connect to the same IP, avoiding DNS caching issues.

Full breakdown with real-world context →

Question 16mediummultiple choice

Read the full Business Continuity, DR & Incident Response explanation →

A company's primary data center experiences a complete power failure, and operations are shifted to a secondary site. The failover process takes 4 hours, but the recovery point objective (RPO) is set to 1 hour. Which of the following is the most likely consequence of this incident?

Trap 1: The failover process was unsuccessful.

Failover succeeded but with data loss beyond RPO.

Trap 2: No data loss occurred because the secondary site was available.

Data written during the 4-hour outage is lost if not replicated.

Trap 3: The recovery time objective (RTO) was not met.

The RTO is not defined; the problem is data loss beyond RPO.

Study all Business Continuity, DR & Incident Response common traps →

A
Data loss of up to 3 hours occurred.
The RPO is 1 hour but failover took 4 hours, causing up to 3 hours of data loss.
B
The failover process was unsuccessful.
Why wrong: Failover succeeded but with data loss beyond RPO.
C
No data loss occurred because the secondary site was available.
Why wrong: Data written during the 4-hour outage is lost if not replicated.
D
The recovery time objective (RTO) was not met.
Why wrong: The RTO is not defined; the problem is data loss beyond RPO.

Full breakdown with real-world context →

Question 17hardmulti select

Read the full Business Continuity, DR & Incident Response explanation →

Which TWO of the following are primary objectives of an incident response plan? (Choose two.)

Trap 1: Ensure business continuity during the incident

BCP handles continuity; IR focuses on response and recovery.

Trap 2: Collect evidence for legal proceedings

Evidence collection is secondary; containment and recovery are primary.

Trap 3: Identify the root cause of the incident

Root cause analysis is part of lessons learned, not an immediate objective.

Study all Business Continuity, DR & Incident Response common traps →

A
Ensure business continuity during the incident
Why wrong: BCP handles continuity; IR focuses on response and recovery.
B
Return affected systems to normal operation
Recovery is a primary objective of IR.
C
Collect evidence for legal proceedings
Why wrong: Evidence collection is secondary; containment and recovery are primary.
D
Minimize the impact of the incident
Containment and mitigation are core IR objectives.
E
Identify the root cause of the incident
Why wrong: Root cause analysis is part of lessons learned, not an immediate objective.

Full breakdown with real-world context →

Question 18easymultiple choice

Read the full Business Continuity, DR & Incident Response explanation →

Refer to the exhibit. A security analyst observes that users from the 192.168.1.0/24 network cannot access HTTPS websites, but HTTP access works fine. What is the most likely cause?

Exhibit

Refer to the exhibit.

! Configuration snippet from router R1
access-list 100 permit tcp 192.168.1.0 0.0.0.255 any eq 80
access-list 100 permit tcp 192.168.1.0 0.0.0.255 any eq 443
access-list 100 deny ip any any log
!
interface GigabitEthernet0/0
 ip access-group 100 in
!

Trap 1: The implicit deny at the end of the ACL blocks HTTPS traffic.

The permit for port 443 comes before the deny, so HTTPS is allowed.

Trap 2: The ACL is missing a permit statement for TCP port 443 return…

ACLs filter based on source/destination; return traffic is handled separately.

Trap 3: The ACL explicitly denies TCP port 443.

The ACL permits port 443.

Study all Business Continuity, DR & Incident Response common traps →

A
The ACL is applied to the wrong interface or direction.
If the ACL is applied inbound on the internal interface, it should work; if applied outbound on the external interface, it may block return traffic. The most likely issue is misapplication.
B
The implicit deny at the end of the ACL blocks HTTPS traffic.
Why wrong: The permit for port 443 comes before the deny, so HTTPS is allowed.
C
The ACL is missing a permit statement for TCP port 443 return traffic.
Why wrong: ACLs filter based on source/destination; return traffic is handled separately.
D
The ACL explicitly denies TCP port 443.
Why wrong: The ACL permits port 443.

Full breakdown with real-world context →

Question 19mediumdrag order

Read the full Business Continuity, DR & Incident Response explanation →

Drag and drop the steps for the TCP three-way handshake into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 20mediumdrag order

Read the full Business Continuity, DR & Incident Response explanation →

Drag and drop the steps for the proper disposal of a hard drive containing sensitive data into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Business Continuity, DR & Incident Response sessions

Start a Business Continuity, DR & Incident Response only practice session

Every question in these sessions is drawn from the Business Continuity, DR & Incident Response domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Business Continuity, DR & Incident Response questions →Mixed CC session

Frequently asked questions

What does the CC exam test about Business Continuity, DR & Incident Response?: Business Continuity, DR & Incident Response questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Business Continuity, DR & Incident Response questions in a focused session?: Yes — the session launcher on this page draws every question from the Business Continuity, DR & Incident Response domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other CC topics?: Use the topic links above to move to related areas, or go back to the CC question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the CC exam covers. They are not copied from any real exam or dump site.

Business Continuity, DR & Incident Response only

10 questions 20 questions 30 questions 50 questions

Mixed CC session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All CC questions Business Continuity, DR & Incident Response domain overview CC exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Business Continuity, DR & Incident Response practice questions

What to know about Business Continuity, DR & Incident Response

Common Business Continuity, DR & Incident Response exam traps

Business Continuity, DR & Incident Response questions

During a ransomware incident, the incident response team isolates affected systems. Which of the following is the NEXT best step?

An organization's recovery time objective (RTO) for its customer database is 4 hours. During a disaster, the backup restore process takes 2 hours, but reconfigure and test tasks add another 3 hours. Which action best addresses this gap?

A SOC analyst receives an alert indicating a user executed a PowerShell script that initiated outbound connections to an external IP. The script was delivered via email attachment. Which incident response phase is MOST appropriate for containing this threat?

A company's business continuity plan includes an alternate work site with full IT capabilities. Which type of recovery site does this describe?

An organization uses a primary data center and a backup site 500 miles away. The backup site replicates data synchronously. Which risk is MOST likely introduced by this configuration?

Which TWO actions are appropriate during the identification phase of incident response?

Which THREE elements are essential components of a business continuity plan (BCP)?

Based on the incident log, at which step did the incident response team contain the threat?

Exhibit

Based on the backup schedule, what is the maximum potential data loss?

Exhibit

Which TWO actions are most effective in reducing the mean time to detect (MTTD) a security incident?

The exhibit shows a syslog-ng client configuration and a firewall rule on the central logging server (IP 10.0.0.10). The client (192.168.1.100) is not sending logs to the server. What is the most likely cause?

Exhibit

A company's primary data center experiences a complete power failure, and operations are shifted to a secondary site. The failover process takes 4 hours, but the recovery point objective (RPO) is set to 1 hour. Which of the following is the most likely consequence of this incident?

Which TWO of the following are primary objectives of an incident response plan? (Choose two.)

Refer to the exhibit. A security analyst observes that users from the 192.168.1.0/24 network cannot access HTTPS websites, but HTTP access works fine. What is the most likely cause?

Exhibit

Drag and drop the steps for the TCP three-way handshake into the correct order.

Drag and drop the steps for the proper disposal of a hard drive containing sensitive data into the correct order.

Track your progress over time

Start a Business Continuity, DR & Incident Response only practice session

Related CC topic practice pages

Access Controls Concepts practice questions