CISSP Security and Risk Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  To determine the maximum acceptable outage for each process

  Why this is correct

  The primary goal of a Business Impact Analysis (BIA) is to systematically identify and quantify the potential impacts of business disruptions and, crucially, to determine the Maximum Acceptable Outage (MAO), also known as Maximum Tolerable Downtime (MTD), for each critical business process. This analysis establishes the absolute longest period a business function can be unavailable before suffering unacceptable consequences, thereby setting critical recovery time objectives (RTOs) that guide subsequent disaster recovery planning and resource allocation.

• ✗

  To test the disaster recovery plan

  Why it's wrong here

  Testing the disaster recovery plan is a distinct phase that occurs *after* the Business Impact Analysis (BIA) and the development of the Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP). The BIA focuses on identifying critical processes and their recovery requirements, while testing validates the effectiveness and viability of the implemented recovery strategies and procedures. Conflating these activities would prematurely attempt to validate a plan that hasn't been fully designed based on proper impact assessment.

• ✗

  To assign roles and responsibilities during a disaster

  Why it's wrong here

  Assigning roles and responsibilities during a disaster is a critical component of the Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP) development and implementation phases, not the primary goal of the Business Impact Analysis (BIA). The BIA's purpose is to identify the impacts of disruptions and prioritize processes, providing the foundational data upon which roles, responsibilities, and specific recovery tasks are subsequently defined within the actionable recovery plans. Without the BIA's output, roles would be assigned without a clear understanding of the most critical functions or their required recovery timelines.

• ✗

  To select a hot site vendor

  Why it's wrong here

  Selecting a hot site vendor is an implementation decision that follows the completion of a Business Impact Analysis (BIA) and the subsequent determination of recovery strategies. The BIA identifies the organization's critical recovery time objectives (RTOs), recovery point objectives (RPOs), and resource requirements, which then inform the specifications for potential recovery sites. Only after these requirements are clearly defined by the BIA can an informed decision be made regarding the selection of an appropriate vendor or recovery solution.

Go deeper

Related to this question