Business Continuity, DR & Incident Response practice questions

Eradication phase

Eradication includes containment actions like blocking IPs and removing malware.

Increased latency for write operations

Synchronous replication forces each write to be acknowledged by the remote site before completing. At 500 miles, round-trip propagation delay alone adds milliseconds to every write, directly increasing write latency and potentially degrading application performance. This is the inherent trade-off of synchronous replication over distance.

Data backup schedules and procedures

Backup schedules and procedures restore lost data at the granularity the BCP requires, directly satisfying the recovery point objective. Without documented, tested backup routines, no continuity strategy can recover corrupted or deleted systems within acceptable data-loss limits.

Business impact analysis (BIA) results

The BIA identifies critical business functions, their dependencies and tolerable downtime, producing the RTO and RPO figures that drive every recovery decision. It satisfies the BCP requirement to prioritise resources based on quantified operational impact rather than assumption.

Emergency contact lists

Emergency contact lists let the continuity team reach key personnel, vendors and stakeholders during an incident, satisfying the plan's communication requirement. Without current contacts, activation and escalation stall, extending downtime regardless of how well recovery procedures are documented.

33 hours (data since Tuesday 01:00)

With backups taken every 33 hours, the worst case is a failure occurring immediately before the next scheduled backup, so all changes since the last successful backup at Tuesday 01:00 are lost. This defines the maximum potential data loss, matching the stated RPO.

Enable multi-factor authentication (MFA) on backup system access

MFA mitigates the risk of credential theft, as the attacker would need an additional factor to authenticate.

Implement a load balancer or proxy with a virtual IP that can be switched during failover, and update the web server configuration to connect to the virtual IP

A virtual IP fronting the database decouples application connection targets from the physical node, so failover redirects traffic at the load balancer without waiting for DNS TTL expiry or cache refresh. This removes the stale-cache dependency that caused the New York web servers to keep hitting the old database IP.

Data loss of up to 3 hours occurred.

RPO defines the maximum tolerable data loss measured in time. With a one-hour RPO and a four-hour outage before failover, the secondary site's last recoverable data may be three hours older than the primary's, so up to three hours of data is lost.

Return affected systems to normal operation

Restoring affected systems to normal operation is a primary incident response objective: containment and eradication are followed by recovery, returning services to a trusted production state. This satisfies the stem's requirement for a core plan objective.

Minimize the impact of the incident

Minimising the impact of the incident is a primary objective: response actions aim to limit damage, reduce downtime and contain scope before full recovery. This directly satisfies the stem's requirement for a core incident response plan objective.

The ACL is applied to the wrong interface or direction.

HTTPS uses TCP 443 while HTTP uses TCP 80. If the ACL blocks 443 but permits 80, the fault lies in where or how the ACL is attached, so traffic is filtered in one direction or on the wrong interface.

DAC: Access decisions are based on the identity of the user and are at the discretion of the resource owner.

Correctly identifies DAC.

MAC: Access decisions are based on security labels and clearance levels.

Correctly identifies MAC.

RBAC: Access decisions are based on the roles assigned to users.

Correctly identifies RBAC.

Symmetric encryption: Uses a single shared key for both encryption and decryption.

Correct. Symmetric encryption relies on one shared secret key for encryption and decryption.

Asymmetric encryption: Uses a pair of keys (public and private) for encryption and decryption.

Correct. Asymmetric encryption uses a public-private key pair for encryption and decryption.

Hashing: Produces a fixed-size output from variable-size input, one-way function.

Correct. Hashing is a one-way function producing a fixed-size digest, not reversible.

Digital signature: Provides authentication, integrity, and non-repudiation using asymmetric cryptography.

Correct. Digital signatures use asymmetric keys to provide these security services.

Recovery Time Objective (RTO) may be exceeded due to long restore

Daily full backups mean every restore copies the entire dataset, so recovery takes far longer than incremental or differential methods. That extended restore duration directly threatens the Recovery Time Objective, the maximum tolerable downtime the business has defined.

Less than 2 hours

A hot standby site runs continuously with replicated data and pre-configured systems, so failover is near-instantaneous rather than requiring rebuild or restore. Since the RTO of 2 hours is the maximum tolerable downtime, actual recovery completes comfortably within that window, satisfying the stated objective.

Ensure employee safety

Protecting people from harm during and after a disruption is a primary BCP objective, taking precedence over asset and process recovery. Employee safety procedures such as evacuation, accounting for staff and communication satisfy this core continuity aim.

Minimize financial loss

Reducing the financial damage caused by disruption is a core BCP objective, achieved by shortening outages and restoring revenue-generating processes quickly. This satisfies the stem's objective requirement, complementing employee safety and continuity of critical business functions.

Add more storage space to the backup target

The log indicates the backup job failed because the target volume ran out of capacity, so expanding storage on the backup target resolves the root cause. Adding space directly satisfies the constraint that writes could not complete due to insufficient free space.

Switch to synchronous replication

Synchronous replication guarantees zero data loss by committing writes to both sites before acknowledging, directly satisfying the report's recovery point objective of zero. Asynchronous replication, by contrast, risks losing recent transactions during failover. This mechanism addresses the identified RPO gap rather than merely improving recovery speed.

Data may not be synchronized with the primary site

A warm site has hardware and connectivity ready but does not continuously replicate production data, so recent transactions may be absent at failover. That synchronisation gap is the most significant risk, causing potential data loss compared with a hot site.

Document the issue and proceed

During a disaster recovery test, the immediate priority is to comprehensively identify all weaknesses within the recovery plan, not to fix issues as they arise. Documenting the generator failure and continuing the test allows the team to uncover further potential problems downstream that might be masked or missed if the test were halted. This approach ensures a complete assessment of the entire disaster recovery process, satisfying the diagnostic objective of a test scenario.

Preparation

Preparation establishes the incident response capability before any incident occurs, covering tooling, training, communications plans and playbooks. It is the first phase of the NIST life cycle, satisfying the stem's requirement for a genuine phase rather than an activity belonging to detection, containment, eradication or recovery.

Containment

Containment is one of the phases in the NIST SP 800-61 incident response life cycle. It limits the spread and impact of an incident after detection and analysis, before eradication and recovery begin, making it a required phase alongside preparation.

Recovery point objective

The recovery point objective defines the maximum tolerable data loss, expressed as time before the incident, and is a standard component of any disaster recovery plan. It directly satisfies the stem's requirement for commonly defined DR plan elements alongside recovery time and scope.

Business impact analysis

Business impact analysis identifies critical processes and their dependencies, underpinning recovery priorities within a disaster recovery plan. It satisfies the stem's requirement for a commonly defined element, since RTOs and recovery strategies derive from the BIA's findings rather than standing alone.

Recovery time objective

The recovery time objective specifies the maximum acceptable downtime for each system, directly guiding recovery sequencing and resource allocation in a disaster recovery plan. It satisfies the stem's requirement for a commonly defined element, complementing the business impact analysis that determines it.