CISSP Practice (Wiley) Business Continuity and Disaster Recovery Planning
Which of the following is the best form of a covered loss insurance policy?
A policy commensurate with risks
Disaster notification fees are part of which of the following cost categories associated with alternative computer processing support?
Activation costs
The decision to fully activate a disaster recovery plan is made immediately:
After damage assessment and evaluation
Regarding contingency planning, which of the following is susceptible to potential accessibility problems in the event of an area-wide disaster?
Alternative storage site and Alternative processing site
Regarding contingency planning, an organization obtains which of the following to reduce the likelihood of a single point of failure?
Alternative telecommunications services
Which of the following is of least concern in a local-area network contingency plan?
Application systems are scheduled for recovery based on a period of downtime tolerable to the application programmers
Which of the following items is usually not considered when a new application system is brought into the production environment?
Assigning a contingency processing priority code
Regarding BCP and DRP, if MAO is maximum allowable outage, BIA is business impact analysis, RTO is recovery time objective, MTBF is mean-time-between-failures, RPO is recovery point objective, MTTR is mean-time-to-repair, and UPS is uninterruptible power supply, which one of the following is related to and compatible with each other within the same choice?
BIA, RTO, RPO, and MAO
Regarding contingency planning, strategic reasons for separating the alternative storage site from the primary storage site include ensuring:
Both sites are not susceptible to the same hazards and Both sites are not colocated in the same area
Regarding contingency planning, information system backups require which of the following?
Both the primary storage site and alternative storage site do not need to be susceptible to the same hazards and Both operational system and redundant secondary system do not need to be colocated in the same area
IT resource criticality for recovery and restoration is determined through which of the following ways?
Business continuity planning and Service-level agreements
Contingency planning integrates the results of which of the following?
Business impact analysis
Which of the following uses both qualitative and quantitative tools?
Business impact analysis
With respect to business continuity planning/disaster recovery planning (BCP/DRP), risk analysis is part of which of the following?
Business impact analysis
Which of the following tools provide information for reaching people during a disaster?
Call tree diagram
If the disaster recovery plan is being tested for the first time, which of the following testing options can be combined?
Checklist testing and structured walk-through testing
Which of the following computer backup alternative sites is the least expensive method and the most difficult to test?
Cold site
A full-scale testing of application systems cannot be accomplished in which of the following alternative computing backup facilities?
Cold sites and reciprocal agreements
Regarding BCP and DRP, which of the following determines the recovery cost balancing?
Cost of system inoperability and the cost of resources to recover
Regarding BCP and DRP, which of the following is not an element of risk?
Costs
Which of the following is most important in developing contingency plans for information systems and their facilities?
Criteria for usefulness
Physical disaster prevention and preparedness begins when a:
Data center site is constructed
Which of the following is often a missing link in developing a local-area network methodology for contingency planning?
Deciding which users must secure and back up their own-data
The most effective action to be taken when a hurricane advance warning is provided is to:
Declare the disaster early
The business impact analysis (BIA) should critically examine the business processes and which of the following?
Dependencies
Which of the following tasks is not a part of business continuity plan (BCP)?
Disaster recovery procedures
Which of the following information technology (IT) contingency solution for servers minimizes the recovery time window?
Disk replication
Regarding BCP and DRP, which of the following IT platforms typically provide some inherent level of redundancy?
Distributed systems
Which of the following may not reduce the recovery time after a disaster strikes?
Documenting the recovery plans
Which of the following is a critical benefit of implementing an electronic vaulting program?
During a crisis situation, an electronic vault can make the difference between an organization's survival and failure
Regarding BCP and DRP, the board of directors of an organization is not required to follow which of the following?
Duty of absolute care
Redundant array of independent disk (RAID) technology does not use which of the following?
Electronic vaulting
The least costly test approach for contingency plans is which of the following?
End-to-end testing
The primary objective of emergency planning is to:
Ensure human security and safety
Which of the following is the best course of action to take for retrieving the electronic records stored at an offsite location?
Ensuring that software version stored offsite matches with the vital records version
What should be the last step in a risk assessment process performed as a part of business continuity plan?
Establish recovery priorities
Which of the following ensures the successful completion of tasks in the development of business continuity and disaster recovery plans?
Exacting individual accountability
Which of the following disaster scenarios is commonly not considered during the development of disaster recovery and contingency planning?
Failure of the local telephone company
The final consideration in the disaster recovery strategy must be which of the following?
Final costs and benefits
Which of the following disaster recovery plan testing approaches is not recommended?
Full-interruption testing
Which of the following disaster recovery plan testing options should not be scheduled at critical points in the normal processing cycle?
Full-interruption testing
Regarding contingency planning, which of the following actions are performed when malicious attacks compromise the confidentiality or integrity of an information system?
Graceful degradation; System shutdown; Fallback to manual mode; Alternate information flows
When an organization is interrupted by a catastrophe, which of the following cost categories requires management's greatest attention?
Hidden costs
An effective element of damage control after a disaster occurs is to:
Hold press conferences
Which of the following alternative computing backup facilities is intended to serve an organization that has sustained total destruction from a disaster?
Hot sites
Which of the following is not an example of procedure-oriented disaster prevention activity?
Housing computers in a fire-resistant area
The main body of a contingency or disaster recovery plan document should not address which of the following?
How? (deals with detailed procedures and information required to carry out the actions identified and assigned to a specific recovery team)
Which of the following organization's functions are often ignored in planning for recovery from a disaster?
Human resources
Which of the following natural disasters come with an advanced warning sign?
Hurricanes and floods
Organizations practice contingency plans because it makes good business sense. Which of the following is the correct sequence of steps involved in the contingency planning process?
Identifying the critical functions; Identifying the resources that support the critical functions; Anticipating potential disasters and Selecting contingency plan strategies
What is the inherent limitation of a disaster recovery planning exercise?
Inability to include all possible types of disasters
Which of the following can be called the disaster recovery plan of last resort?
Insurance policy
The first step in successfully protecting and backing up information in distributed computing environments is to determine data:
Inventory requirements
All the following are misconceptions about a disaster recovery plan except:
It is an organization's assurance to survive
Examples of vital records follows:
Legal records; Accounting/finance records; Marketing records; Human resources records
A company's vital records program must meet which of the following?
Legal, audit, and regulatory requirements; Accounting requirements; Marketing requirements; Human resources requirements
Which of the following disaster recovery plan test results would be most useful to management?
List of successful and unsuccessful activities
Which of the following IT contingency solutions increases a server's performance and availability?
Load balancing
Which of the following statements is not true? Having a disaster recovery plan and testing it regularly:
Lowers insurance rates
Which of the following is a prerequisite to developing a disaster recovery plan?
Management commitment
All the following are objectives of emergency response procedures except:
Maximize profits
An information system's recovery time objective (RTO) considers which of the following?
Maximum allowable outage and Cost to recover
Regarding BCP and DRP, which of the following establishes an information system's recovery time objective (RTO)?
Maximum allowable outage time and the cost to recover
The business continuity planning (BCP) process should focus on providing which of the following?
Minimum acceptable level of outputs and services
Which of the following disaster-recovery alternative facilities eliminates the possibility of competition for time and space with other businesses?
Mirrored sites
Which of the following phases in the contingency planning and emergency program is most difficult to sell to an organization's management?
Mitigation
Regarding business continuity planning (BCP) and disaster recovery planning (DRP), which of the following contingency solutions for wide-area networks (WANs) increases vulnerability to hackers?
Multiple Internet connections
Which of the following IT contingency solutions for servers provides high availability?
Network-attached storage
With respect to BCP/DRP, single point of failure means which of the following?
No redundancy exists
Regarding BCP and DRP, which of the following does not prevent potential data loss?
Offsite storage of backup media
Regarding contingency planning, system-level information backups do not require which of the following to protect their integrity while in storage?
Passwords
Which of the following is the correct sequence of events when surviving a disaster?
Plan, test, respond, recover, and continue
Which of the following requires advance planning to handle a real flood-driven disaster?
Power requirements and air-conditioning requirements
Which of the following statements is not true about the critical application categories established for disaster recovery planning purposes?
Predefined categories need not be followed during a disaster because time is short
Which of the following is the best organizational structure and management style during a disaster?
Production-oriented
Rank the following objectives of a disaster recovery plan (DRP) from most to least important:
Protect the organization's employees and the general public; Minimize the disaster 's financial impact on the organization; Limit the extent of the damage and thus prevent the escalation of the disaster and Reduce physical damage to the organization's property, equipment, and data
Rank the following benefits to be realized from a comprehensive disaster recovery plan (DRP) from most to least important:
Provide continuity of organization's operations; Improve protection of the organization's assets; Enhance physical and data security and Reduce insurance costs
Regarding BCP and DRP, redundant array of independent disk (RAID) does not do which of the following?
Provide power redundancy
All of the following are key stakeholders in the disaster recovery process except:
Public relations officers
All the following need to be established prior to a crisis situation except:
Public relationships
Which of the following computing backup facilities has a cost advantage?
Reciprocal agreements
A contingency planning strategy consists of the following four parts. Which of the following parts are closely related to each other?
Recovery and resumption
Which of the following should be consistent with the frequency of information system backups and the transfer rate of backup information to alternative storage sites?
Recovery time objective and Recovery point objective
Disaster recovery strategies must consider or address which of the following?
Recovery time objective; Disruption impacts; Allowable outage times; Interdependent systems
Regarding BCP and DRP, critical measurements in business impact analysis (BIA) include which of the following?
Recovery time objectives and recovery point objectives
Contingency planning for local-area networks should consider all the following except:
Remote computing
The greatest cost in data management comes from which of the following?
Restoring files
A major risk in the use of cellular radio and telephone networks during a disaster include:
Security and switching office issues
Which of the following tasks is not a part of disaster recovery planning (DRP)?
Selecting an alternate processing site
Business continuity plans (BCP) need periodic audits to ensure the accuracy, currency, completeness, applicability, and usefulness of such plans in order to properly run business operations. Which one of the following items is a prerequisite to the other three items?
Self-assessments
An organization's effective presentation of disaster scenarios should be based on which of the following?
Severity and timing levels
Which of the following statements is not true about contracts and agreements associated with computer backup facilities?
Small vendors do not need contracts due to their size
When comparing alternative computer processing facilities, the major objective is to select the alternative with the:
Smallest annualized cost
The major threats that a disaster recovery contingency plan should address include:
Software threats and environmental threats
Which of the following IT contingency solutions is useful over larger bandwidth connections and shorter physical distances?
Synchronous mirroring
Which of the following IT contingency solutions provides recovery time objectives (RTOs) ranging from minutes to several hours?
Synchronous mirroring
Which of the following IT contingency solutions requires a higher bandwidth to operate?
Synchronous mirroring
The IT operations management of KPQ Corporation is concerned about the reliability and availability data for its four major, mission-critical information systems that are used by business end-users. The KPQ corporate management's goal is to improve the reliability and availability of these four systems in order to increase customer satisfaction both internally and externally. The IT operations management collected the following data on downtime hours that include scheduled maintenance hours and uptime hours for all these systems. Assume 365 operating days per year and 24 hours per day for all these systems. The KPQ functional management thinks that the security goal of availability is more important in ensuring the continuity of business operations than the confidentiality and integrity goals. This is because the availability goal will ensure timely and reliable access to and use of system-related data and information, as it is an indicator of quantity of service. System Downtime, hours Uptime, hours 1 200 8,560 2 150 8,610 3 250 8,510 4 100 8,660 Which of the following systems has the highest availability in a year expressed in percentages and rounded up?
System 4
Which of the following is an operational control and is a prerequisite to developing a disaster recovery plan?
System backups
Which of the following are closely connected to each other when conducting business impact analysis (BIA) as a part of the IT contingency planning process?
System's critical resources and System's downtime impacts
Which of the following contingency plan test results is most meaningful?
Tests met all planned objectives using files recovered from backups
Which of the following is an example of a recovery time objective (RTO) for a payroll system identified in a business impact analysis (BIA) document?
The LAN server must be recovered within 8 hours to avoid a delay in time sheet processing
Which of the following is the most important outcome from contingency planning tests?
The results of a test should be used to improve the plan
For business continuity planning/disaster recovery planning (BCP/DRP), business impact analysis (BIA) primarily identifies which of the following?
Threats and risks
What is the purpose of a business continuity plan (BCP)?
To sustain business operations
After a disaster, at what stage should application systems be recovered?
To the actual point of interruption
In transaction-based systems, which of the following are mechanisms supporting transaction recovery?
Transaction rollback and Transaction journaling
Which of the following must be defined to implement each contingency plan?
Triggers
Which of the following is the most important consideration in locating an alternative computing facility during the development of a disaster recovery plan?
Unlikely to be affected by the same contingency issues as the primary facility
What is an alternative processing site that is equipped with telecommunications but not computers?
Warm site
The post-incident review report after a disaster should not focus on:
Who caused it?
Regarding contingency planning, which of the following IT platforms requires vendor service-level agreements?
Wide-area networks
