CISSP Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  BCP ensures continuity of business operations; DRP restores IT infrastructure

  Why this is correct

  The Business Continuity Plan (BCP) is a strategic, high-level plan focused on ensuring the continued operation of critical business functions and processes during and after a disruptive event. Its primary objective is to maintain essential organizational activities, people, and facilities. In contrast, the Disaster Recovery Plan (DRP) is a tactical subset of the BCP, specifically detailing the procedures for restoring an organization's technology infrastructure, including systems, applications, and data, to an operational state.

• ✗

  BCP only addresses natural disasters; DRP addresses all disasters

  Why it's wrong here

  This statement is incorrect because both Business Continuity Plans (BCP) and Disaster Recovery Plans (DRP) are designed to address a comprehensive range of potential disruptive events, not solely natural disasters. Their scope extends to human-made incidents, technological failures, cyberattacks, pandemics, and other unforeseen circumstances that could impact an organization's ability to operate. Effective resilience planning requires considering all relevant threats identified through a thorough risk assessment.

• ✗

  BCP is tested annually; DRP is tested monthly

  Why it's wrong here

  The assertion that BCP is tested annually and DRP monthly is a generalization and not a defining difference between the plans. Testing frequency for both BCP and DRP components is determined by factors such as the criticality of the system or process, regulatory requirements, risk appetite, and the results of previous tests. While certain DRP elements like data backups might be tested frequently, full BCP or DRP exercises are typically conducted less often, often annually or semi-annually, depending on organizational policy and risk.

• ✗

  BCP focuses on IT restoration; DRP focuses on business processes

  Why it's wrong here

  This statement incorrectly reverses the primary focus of each plan. A Business Continuity Plan (BCP) is fundamentally concerned with the continuity of core business processes and operations, ensuring the organization can continue delivering critical products or services. Conversely, a Disaster Recovery Plan (DRP) is specifically focused on the technical restoration of the underlying IT infrastructure, systems, and data that support those business processes, making it a critical component of the broader BCP.

Go deeper

Related to this question