mediumMultiple Select
ISC2 CC Practice Question: Which TWO of the following are valid types of…
Which TWO of the following are valid types of disaster recovery tests?
⚠ Common exam trap
CC often tests the definitions of DR test types; candidates may confuse parallel tests with full-scale simulations, but the key is that parallel tests run both sites simultaneously, while full-scale simulations without notification are not standard.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Tabletop exercise.
A tabletop exercise (A) is a valid disaster recovery test in which the DR team walks through the plan in a discussion-based setting to validate roles, procedures, and decision-making without activating systems. A parallel test (E) is also valid: the backup site is brought online and run concurrently with the primary site to verify recovery capability while normal production continues, without a disruptive failover. The other options are not DR test types: a full-scale simulation without prior notification (B) is not a recognized test category (full-scale exercises are typically announced and planned), unit testing (C) verifies individual application components rather than end-to-end recovery, and a vulnerability scan (D) is a security assessment, not a DR test.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Tabletop exercise.
Why this is correct
A tabletop exercise is a discussion-based test where stakeholders walk through recovery procedures without activating systems, satisfying the requirement for a valid disaster recovery test type. It validates plans, roles and decision-making cheaply, unlike full failover tests, and is formally recognised alongside simulation and parallel testing in DR planning frameworks.
- ✗
Full-scale simulation without prior notification.
Why it's wrong here
Unannounced full-scale simulations disrupt production and risk data, so they are not a recognised DR test type; valid tests are planned and controlled. An unannounced exercise would suit testing live incident response readiness, where disruption is the intended condition.
- ✗
Unit testing of individual applications.
Why it's wrong here
Unit testing verifies individual application code behaviour, not the recovery of infrastructure and services after a disaster. It is correct during software development to validate functions in isolation, which is unrelated to DR test categories.
- ✗
Vulnerability scan.
Why it's wrong here
A vulnerability scan identifies software flaws and missing patches; it exercises no recovery procedure, so it cannot validate restoration of services. It is tempting because scanning supports resilience planning, and it would be the right choice when the requirement is to find exploitable weaknesses in systems before an incident occurs.
- ✓
Parallel test between primary and backup site.
Why this is correct
A parallel test runs the backup site alongside the primary in production mode, proving recovery capability while the primary keeps serving. This satisfies the requirement for a valid disaster recovery test type with controlled risk.
Go deeper
Related to this question
Learn chapter
BC/DR Planning and Testing
Key term
Disaster recovery
Disaster recovery is a set of policies, procedures, and tools that help an organization restore critical IT systems and data after a disruptive event.
Key term
Vulnerability scan
A vulnerability scan is an automated process that checks systems, networks, and applications for known security weaknesses or misconfigurations.
About these practice questions
One of 989 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.