92 *SURGENT MCQ Flashcards
A 15,000-employee multinational company that produces and distributes retail products for home use has moved financial consolidation and reporting off its large mainframe computer system at headquarters to local area networks (LANs) with file servers. The mainframe system was doing the job of processing 200,000 transactions a month, but its batch processing was cumbersome and time consuming. It also did not have automatic interfaces to all the subsidiaries, especially those in other countries, due to software and hardware incompatibilities.
Aware of the threat of physical disasters to make the LANs unavailable, the implementation team wrote a disaster recovery plan that documented procedures for data and program backup and recovery, power backup, emergency equipment acquisition, and hot site services. The disaster recovery plan requires:
normalizing.
capacity planning.
performance monitoring.
frequent updating.
frequent updating.
The correct answer is “frequent updating” because local area networks (LANs) are typically ever-changing. Each LAN configuration change, such as adding or modifying hardware, software, or network components, will require corresponding modifications to the disaster recovery plan. Frequent updates ensure the plan remains relevant and effective in addressing new configurations and potential vulnerabilities.
A disaster recovery plan allows a company to quickly resume normal business activities after a break in those activities due to a system failure or a natural disaster. A disaster recovery plan needs to include:
recovery priorities,
insurance,
specific assignments for employees and departments,
backup facilities,
periodic testing of the recovery plan, and
complete documentation of the recovery plan (stored off-site).
The other answer choices are incorrect:
While capacity planning is an important aspect of IT management, it is not the primary focus of a disaster recovery plan. Capacity planning assesses and ensures that resources, such as storage, processing power, and network bandwidth, are sufficient to meet current and future needs.
Normalization typically relates to database design and is not directly related to the disaster recovery plan. Normalization is organizing data in a database to minimize redundancy and improve data integrity.
Performance monitoring, while important for maintaining the efficiency of IT systems, is not the primary requirement of a disaster recovery plan. Performance monitoring focuses on tracking system performance and identifying bottlenecks or issues that impact system speed and responsiveness.
Relevant Terms
Batch Processing
Consolidation
Hot Site
Implementation
Local Area Network (LAN)
Subsidiary
Reference
7113.38
A factor in estimating the maximum tolerable downtime during a disaster is:
availability of a cold site during the disaster.
availability of a hot site.
type of hardware used.
applications affected by the disaster.
applications affected by the disaster.
When a disaster strikes an organization, the maximum tolerable downtime depends on the time of the disaster, application systems affected by the disaster, and the length of the disaster. Disaster during a fiscal period accounting closing may be different from disaster during normal periods. Some application systems are more important than others for an organization. By understanding the costs of various downtime lengths and comparing them to relevant costs for various recovery choices, one can determine the maximum downtime.
The other answer choices are incorrect: It is the costs that need to be considered, not the availability of hot and cold sites needed for the estimate. The type of hardware used is essential in developing the plans but not in estimating the maximum downtime.
Term: Security
Security is the preservation of the authenticity, integrity, confidentiality, and ensured service of any sensitive or non-sensitive computer system-valued function and/or information element.
Security is a system property and much more than a set of functions and mechanisms. Information system security is a system characteristic as well as a set of mechanisms that span the system both logically and physically.
Relevant Terms
Security
Reference
7113.24
A large e-commerce platform is being audited to ensure it meets its availability service commitments per the Trust Services Criteria (TSC). In a SOC 2® engagement, which of the following actions is most effective for the auditor to detect deficiencies in design and deviations in controls related to the service organization’s availability of service commitments?
Reviewing the financial records of the service organization
Assessing the quality of customer support provided by the services organization
Conducting interviews with internal teams of the service
Analyzing control documentation and conducting tests on system redundancy mechanisms
Analyzing control documentation and conducting tests on system redundancy mechanisms
This action involves examining control design and operational effectiveness to detect deficiencies and deviations in controls related to service availability. It assesses whether the organization’s documented controls and redundancy mechanisms align with its availability service commitments and whether they function as intended.
The other answer choices are incorrect:
Reviewing financial records is not directly related to detecting deficiencies in the design and deviations in the operation of controls for service availability. Financial records are more pertinent to financial controls and may not provide insights into availability controls.
Assessing customer support quality is valuable but primarily relates to customer service standards and may not directly address controls for service availability. Availability controls focus on system uptime and accessibility.
While conducting interviews with internal teams can provide valuable information, it is not the most effective action for detecting deficiencies in the design and deviations in the operation of availability controls. Interviews may complement the assessment but do not substitute for thoroughly examining control documentation and conducting tests on redundancy mechanisms more directly related to availability service commitments.
Term: SOC 2 Type 1 Report
In a SOC 2® Type 1 report, the service auditor provides an opinion as to whether the service organization’s description “fairly presents” the system that was designed and implemented, and whether the controls were suitably designed to meet the criteria as of a specified date.
Term: SOC 2 Type 2 Report
In a SOC 2® Type 2 report, the service auditor provides an opinion on whether the service organization’s description “fairly presents” the system that was designed and implemented; the controls were suitably designed to meet the criteria; the controls operated effectively during the specified period of time; and the service organization is in compliance with the commitments in its statement of privacy practices, if the report covers the privacy principle.
Term: Trust Services
Trust Services consist of professional attestation and advisory services based on principles and criteria that address the risk and opportunities of IT-enabled systems and privacy programs, including electronic commerce (e-commerce) systems. Trust Services principles and criteria are issued by the AICPA and the Canadian Institute of Chartered Accountants (CICA) and are organized into four broad areas: policies, communications, procedures, and monitoring.
Reference
7113.14
A large organization has developed a disaster recovery plan for several offices dispersed across a broad regional area. Which of the following is the most cost-effective test of the disaster recovery plan?
Full-interruption test
Structured walk-through
Regression test
Preparedness test
Preparedness test
Each local office/area executes this test to validate the adequacy of the preparedness of regional operations for disaster recovery.
The other answer choices are incorrect:
The full-interruption test is conducted after the preparedness test. In a full-interruption test, operations are shut down at the primary site and relocated to the recovery site following the recovery plan; this is the most rigorous form of testing. Full-interruption tests are difficult to arrange, expensive, and possibly disruptive.
In a structured walk-through (often referred to as a tabletop exercise) team members role-play a disaster scenario, execute the plan on paper, discuss their roles, review each step to evaluate its effectiveness, and discuss the appropriate responses to the disaster. This test is not sufficient to test the viability of the plan.
The regression test is used in software development and maintenance.
Reference
7113.20
7113.63
A large property insurance company has regional centers that customers call to report claims. Although the regional centers are not located in areas prone to natural disasters, the company needs a disaster recovery plan to restore call-answering capacity in the event of a disaster or other extended loss of service. The best plan for restoring capacity in the event of a disaster would be to reroute call traffic to::
a third-party service center.
a cold site that duplicates regional facilities.
a hot site that duplicates regional facilities.
non-affected regional centers.
non-affected regional centers.
The operation and expertise available at other regional centers should be on par with the regional center disabled by the disaster. This would also be the least costly alternative.
a cold site that duplicates regional facilities.
A cold site duplicating regional facilities would be costly and not provide personnel and other requisites of a normal division.
a hot site that duplicates regional facilities.
A hot site would duplicate facilities and some software, but not personnel, and it would be costly.
a third-party service center.
Rerouting call traffic to a third-party service center alternative would be expensive and would still not provide the needed expertise and training to handle the more complex calls.
Relevant Terms
Cold Site
Disaster Recovery Plan
Hot Site
Reference
7113.83
A prerequisite to a successful contingency plan is:
independent audits.
legal reviews.
security reviews.
management approvals.
management approvals.
A prerequisite to a successful contingency plan is management commitment and approval. A successful contingency plan needs management funding and support.
The other answer choices are incorrect: An independent audit and a security review of the plan can validate the soundness of the proposed contingency strategy. Similarly, a legal review can ensure that the plans comply with government regulations and that those liabilities and exposures are adequately addressed.
Relevant Terms
Contingency Plan
Reference
7113.17
A retail store uses batch processing to process sales transactions. The store has batch control total and other control checks embedded in the information processing system of the sales subsystem. While comparing reports, an employee notices that information sent to the subsystem was not fully processed. Which of the following types of controls is being exercised by the employee?
Input
Preventive
Corrective
Detective
Detective
The correct answer is a detective control. The employee is exercising a detective control by noticing that information sent to the subsystem was not fully processed. Detective controls uncover (i.e., discover) problems as they occur.
The other answer choices are incorrect:
Preventive controls eliminate problems before they occur.
Corrective controls help solve problems after they are discovered. To ensure system reliability, companies should implement a set of preventive controls and supplement them with methods for detecting incidents and procedures for taking corrective remedial action; employing multiple layers of controls so that if one control fails or is circumvented, another control will prevent, detect, or correct the reliability breakdown.
Input is a process for entering data into the processing system; it is not a control in and of itself.
Relevant Terms
Batch Processing
Batch Total
Corrective Controls
Detective Control
Preventive Controls
Reference
7113.43
7113.43 table
A vital data backup and storage program must meet which of the following requirements?
Auditing
Accounting
Insurance
Regulatory
Regulatory
Laws and regulations may impact how an organization can handle and manage data backup and storage and should be considered in establishing and developing methods for data handling. Regulatory requirements dictate the length of the time an organization must retain a particular record or document to support its business activities.
The other answer choices are incorrect. Regulatory requirements do not directly dictate insurance, accounting, and auditing. Auditors review compliance with such regulatory requirements. Before records retention, each organization must identify what records and documents are vital to its operations.
Data Backup Storage
Relevant Terms
Backup
Documentation
Reference
7113.01
Although both disaster recovery planning and security policies enhance the availability of information, these policies:
are separate with no substitution.
can be in one document.
are separate and diverse.
are separate but complementary.
are separate but complementary.
A comprehensive disaster recovery plan is separate from but complementary to the security policy document. The purpose of recovering planning and security policies is to allow a business to continue offering critical services and business operations in the event of a disruption and withstand an interruption to business activities.
The other answer choices are incorrect: Security policies are high-level statements that address senior management’s intent and direction. In comparison, the disaster recovery policy is more concerned with the disaster recovery plan specifications. Thus, they should be separated, but both items will go hand in hand and complete each other.
Reference: 7113.17
A prerequisite to a successful contingency plan is management commitment and approval. However, disaster recovery planning and security policies are separate but complementary.
The purpose of business continuity and disaster recovery is to allow a business to continue offering critical services and business operations in the event of a disruption and withstand an interruption to business activities. Computer backup facilities, disaster recovery, business resumption, or contingency planning problems and issues pose significant challenges and concerns to information systems (IS) management, senior management, functional user management, and audit management. The key issues are how to develop disaster recovery plans, how to test them, how to maintain them, and how to keep the continuity of operations.
The business continuity plan (BCP) and disaster recovery plan (DRP) can allow critical processes to resume in a disruption of normal business operations. Responsibility for the BCP remains with senior management, but the execution usually stays with the business units and the appropriate supporting units.
The BCP should undertake all functions and assets critical to continue as a viable operation immediately after encountering a disruption.
Relevant Terms
Disaster Recovery Plan
Security Policy
Reference
7113.17
C21 Determining the criticality of an application system in the production environment is important to allocate scarce resources to highly critical systems. The best way to accomplish this objective is to:
ask the application programmer who is developing and/or maintaining the system.
ask the computer operators who are running day-to-day production jobs.
ask the internal and external auditors during their routine audit work.
ask the end users how they would continue their operations if the system were unavailable for a specified time period.
ask the end users how they would continue their operations if the system were unavailable for a specified time period.
The correct answer is “ask the end users how they would continue their operations if the system were unavailable for a specified time period.” Since application systems are designed to provide data and information to end users, the users are in the best position to assess the value or usefulness of the system to their business operations.
The other answer choices are incorrect: Input from the other three parties (application programmers, computer operators, and auditors) is important but not as important as that of end users. The other parties’ views are limited.
IT Business Continuity Planning - 21
Question #600031
Mission-Critical System
Security
IT Business Continuity Planning
7113.21
The frequency of file backups should depend primarily on the criticality of the application system:
rules.
documentation.
edits.
functions.
functions.
The frequency of file backup must depend on the criticality of the application system functions and data. Critical data should be backed up using the “grandfather-father-son” method. Backup of operating systems software and application programs must be performed whenever they are modified or updated.
The other answer choices are incorrect: Whether the application system has rules, documentation, or edits does not matter when it comes to the frequency of backup.
Data Backup Storage
Relevant Terms
Backup
Reference
7113.11
During a disaster, which of the following application systems should be recovered first?
Mission-critical systems alone
Mission-critical systems and systems dependent on mission-critical systems
All systems
Mission-critical systems and systems on which mission-critical systems depend
Mission-critical systems and systems on which mission-critical systems depend
Since the recovery time window is short during a disaster, organizations must prioritize application systems, deciding which should be run first.
The other answer choices are incorrect: The mission-critical systems should be run before noncritical systems. To run mission-critical systems, any systems that are needed by the mission-critical systems must also be started.
Term: Mission-Critical System
A mission-critical system is a system supporting a core business activity or process.
Reference: 7113.21
The IT business continuity plan (BCP) should be aligned with the strategy of the organization. Most key business processes depend on the availability of critical systems infrastructure components and business applications. The criticality of the several application systems deployed in the organization depends on the nature of the business, the value of each application, and the importance to the business.
The information system BCP/DRP (disaster recovery plan) is an essential component of an organization’s business continuity and disaster recovery strategy. An IT/DRP is a structured collection of processes and procedures designed to accelerate response and ensure business continuity in the event of a disaster.
Relevant Terms
Disaster Recovery Plan
Mission-Critical System
Reference
7113.21
Fire has swept through the premises of an organization’s computer room. The company has lost its entire computer system. The best thing the organization could have done is to:
plan for mutual agreements—negotiate with other similar organizations to back each other.
plan for cold-site arrangements.
plan for warm-site arrangements since everything was ready to go.
take daily backups to an offsite storage facility.
take daily backups to an offsite storage facility.
Daily backups taken to an offsite storage facility can minimize damage. A whole company can suffer when disaster strikes. A crucial component of disaster recovery planning (DRP) is the availability of adequate data. Duplication of critical data, information, and documentation, including offsite storage such as backup data and paper records, is a condition for any recovery.
The other answer choices are incorrect: Hot/warm/cold sites and mutual agreements require backups to continue with business operations. “No backup, no recovery” should be practiced.
Reference: 7113.06
Media and documentation backup
A crucial component of disaster recovery planning is the availability of adequate data. Duplication of critical data, information, and documentation, including offsite storage such as backup data and paper records, is a condition for any recovery. The type of data to be stored offsite depends on factors such as legal, business, and regulatory requirements.
Offsite storage locations should be identified to store the magnetic media, paper documentation, and forms needed to run the backup computer in the event of a disaster. Care should be taken to select an offsite storage location, whether it is a part of the organization or an outside commercial storage center situated locally or remotely to the primary site.
7113.11 Table
Implementing an effective insurance recovery program can:
substitute for a disaster recovery plan.
eliminate the need for a disaster recovery plan.
alter the need for a disaster recovery plan.
complement a disaster recovery plan.
complement a disaster recovery plan.
An effective insurance recovery program does not alter, eliminate, or substitute the need for a comprehensive disaster recovery plan but rather complements such a plan. This is because both have different but valuable purposes. They work best together.
Disaster Recovery Plan
Reference
7113.38
In a SOC 2® engagement, what is the primary focus when assessing controls related to the availability of service commitments and system requirements?
Ensuring data confidentiality
Validating data accuracy
Verifying compliance with legal regulations
Evaluating system uptime
Evaluating system uptime
In a SOC 2 engagement, the primary focus when assessing controls related to availability service commitments and system requirements is evaluating system uptime and availability. Availability controls aim to ensure that systems and services are available and operational when needed by clients and users. Therefore, assessing and evaluating system uptime and availability is a central aspect of a SOC 2 examination.
The other answer choices are incorrect:
Ensuring data confidentiality is not the primary focus when assessing controls related to availability service commitments and system requirements in a SOC 2 engagement. While data confidentiality is important, the primary concern in this context is the availability and uptime of the systems and services.
Validating data accuracy is related to data integrity, one of the Trust Services Criteria in a SOC 2 examination. However, the primary focus of this question is on assessing controls related to availability service commitments and system requirements, which primarily concern the availability and uptime of systems rather than data accuracy.
Verifying compliance with legal regulations, while important for overall compliance and security, is not the primary focus when assessing controls related to availability service commitments and system requirements in a SOC 2 engagement. SOC 2 primarily evaluates controls that ensure systems and data availability, security, and processing integrity.
Relevant Terms
Availability (Trust Services Criteria)
SOC 2 Type 1 Report
SOC 2 Type 2 Report
System and Organization Controls (SOC) Reports
Reference
7113.14
In developing a business continuity plan (BCP) for an organization, which of the following would be done first?
Roles and responsibilities of BCP team members
Critical areas of threats and vulnerabilities
Functional user operations
Conducting a business impact analysis (BIA)
Conducting a business impact analysis (BIA)
The BIA is a critical step in establishing the business continuity strategy and executing the risk countermeasures and the BCP. The first phase in any disaster recovery plan is to conduct a BIA. The BIA identifies the critical resources, processes, systems, and applications to the organization’s ongoing sustainability and threats to business priorities, processes, and resources.
The other answer choices are incorrect:
Most disaster recovery plans focus on data-processing functions, not other functions within the organization. IS management may assume that functional users will be responsible for their areas.
Identifying the critical areas of threats and vulnerabilities provides a basis for the development of the rest of the recovery plan.
With increased automation of business functions, a certain amount of coordination and planning are required between the IS management and the functional user management. As a result, team members’ roles and responsibilities are often defined, threats and vulnerabilities are analyzed, and impacts are analyzed and may not be documented.
Reference: 7113.15
A business continuity plan (BCP) aims to sustain business operations. The BCP objective is to ensure the organization’s sustained viability if unforeseen emergencies occur. BCP is used to sustain the continued operation of a business in the event of an emergency.
Contingency planning involves more than planning to move offsite after a disaster destroys a data center. It also addresses how to keep an organization’s critical functions operating in the event of large and small disruptions. This broader perspective on contingency planning is based on the distribution of computer support throughout an organization.
Reference: 7113.23
The BIA (business impact analysis) is a critical step in establishing the business continuity strategy and executing the risk countermeasures and the business continuity plan (BCP). The first phase in any disaster recovery plan is to conduct a BIA. The BIA identifies the critical resources, processes, systems, and applications to the organization’s ongoing sustainability and threats to business priorities, processes, and resources. It evaluates the probability of each threat that may occur and the impact on the business and helps to determine the acceptable downtime for the business-critical processes and applications.
7113.15
7113.16
7113.20
7113.23
In one company, the application systems must be in service 24 hours daily. The company’s senior and information systems management have worked hard to ensure that the information systems recovery plan supports the business disaster recovery plan. A crucial aspect of recovery planning for the company is ensuring that:
changes to systems are tested thoroughly before being placed into production.
management personnel can fill in for operations staff should the need arise.
capacity planning procedures accurately predict workload changes.
organizational and operational changes are reflected in the recovery plans.
organizational and operational changes are reflected in the recovery plans.
The correct answer is “organizational and operational changes are reflected in the recovery plans” because such changes have the potential to make the recovery plans inapplicable.
The other answer choices are incorrect:
System changes must be tested thoroughly before being placed into production, but that is not a part of recovery planning.
A good recovery plan would specify how operational staff might be replaced should the need arise, but their replacements might not be management personnel.
Predicting workload changes accurately permits a company to minimize its information systems facility costs, but that is not a part of recovery planning.
Disaster Recovery Plan
Reference
7113.36
7113.37
7113.38
7113.39
In which of the following alternate computing backup facilities must vendors deliver computer hardware before it can be used?
Reciprocal agreements
Hot sites
Shared contingency centers
Cold sites
Cold sites
A cold site is an empty shell facility and does not have equipment. In the event of a disaster, the computer vendor delivers the required hardware and equipment to the facility, so full-scale testing cannot be done until the equipment is installed.
The other answer choices are incorrect:
In a reciprocal agreement, one organization agrees to provide backup and recovery facilities with a compatible hardware and software configuration for another organization and vice versa.
Full-scale testing is possible with shared contingency centers and hot sites. Shared contingency centers are essentially the same as dedicated contingency centers. The difference lies in the fact that membership is formed by a group of similar organizations that use identical hardware. The hot site has servers, workstations, and communications links ready to support critical applications.
7113.52
Jim is an auditor who is conducting an audit of business continuity. Which of the following is the most crucial for Jim to review?
A hot site is available.
A business continuity plan is available and up to date.
Insurance coverage is adequate.
Timely media backups are taken on and stored at an offsite location.
Timely media backups are taken on and stored at an offsite location.
All other components of the recovery efforts are at risk if the data to process is not available.
The other answer choices are incorrect as the lack of data is more critical for the auditor to review compared to the other options. Without data, the business continuity plan will fail.
Reference: 7113.86
The auditor’s role in developing and testing the disaster recovery plan may need clarification for other team participants. Several teams participate in the planning and testing efforts, and misunderstandings and misinterpretations can develop amongst team members due to a lack of communication. The auditor’s role in developing and testing the disaster recovery or contingency plan should be clear to all teams. As a member of the testing team, the auditor reviews test results along with functional users to validate the accuracy of critical application testing results. The auditor does not make decisions or supervise the team members; that is management’s responsibility. The auditor plays a consulting and participative role in the disaster recovery/contingency plan development and testing. The auditor is an observer, reviewer, and reporter of disaster planning, testing, and recovery‐related actions.
Reference: 7113.87
Some specific role-related activities in which the auditor participates are noted below:
Attend meetings where issues are raised, problems are discussed, and solutions are suggested in areas related to contingency plans.
Review the adequacy of planning documents and backup and recovery site vendor’s proposals for rendering these services; suggest improvements as required.
1 Participate in testing the plan at the backup and recovery vendor’s site along with functional users and staff, observe the testing process, and suggest cost-effective improvements to the plan based on feedback from the testing experience.
- Ensure that functional users review the application test results by comparing them with known values or other means to ensure that the data files are up to date and that the application programs and operating systems are the correct versions at the primary and backup sites.
Simulate a disaster with the help of senior management to test the effectiveness of recovery and resumption procedures.
Reference: 7113.88
An auditor should evaluate and assess the following attributes that support the business continuity plan (BCP):
Reviewing the business continuity plan and documentation
Reviewing the applications included in the business continuity plan
Assessing prior test results
Assessing offsite storage
Assessing security controls at the offsite storage facility
Interviewing key personnel
Assessing the alternative processing contract
Assessing insurance coverage
Kelly is conducting a business impact assessment for her organization. What metric provides important information about the amount of time the organization may be without service before causing irreparable harm?
SDO
RTO
RPO
MTD
MTD
The correct answer is MTD, the maximum tolerable downtime. MTD indicates the longest period a business function can be unavailable before causing severe damage to the business. MTD is a useful metric to determine the level of business continuity resources to assign to a particular function. This measure is sometimes called maximum tolerable outage (MTO).
SDO
The service delivery objective (SDO) is the level of services to be reached during the alternate process mode until the original/normal situation is restored. SDO is related to business needs.
RTO
The recovery time objective (RTO) is determined based on the acceptable downtime or target time in case of a disruption of business operations and systems. The RTO indicates the earliest point in time that business operations and IT systems should recover and resume after a disaster. RTOs are measured when the business resumes use, not when IT restores systems.
RPO
The recovery point objective (RPO) is the defined level of recovery determined based on the acceptable data loss in case of interruption of operations. The RPO designates the earliest point in time that it is acceptable to recover the data.
Relevant Terms
Business Continuity Plan (BCP)
Business Impact Analysis (BIA)
Reference
7113.24
7113.48
Mark is an auditor who is assessing the resilience of a high-availability network. Mark should be most concerned if:
a hot site is prepared for activation.
the structure is geographically scattered.
diverse routing is installed for the network.
the servers are clustered in one site.
the servers are clustered in one site.
A clustered setup in one site makes the entire network vulnerable to natural disasters or other interruptive events.
The other answer choices are incorrect:
Scattered geographic locations provide backup if a destructive event has impacted a site.
A hot site would be a good alternative for a single-point-of-failure site.
When a network is not available, diverse routing provides telecommunications backup.
Reference: 7113.90
A single point of failure (SPOF) is any component that can cause an entire system to fail. A single-point-of-failure system is very risky since it is like putting “all the eggs in one basket.” If attacks on these systems are successful, then the entire system is compromised. If a server has data on a single disk, failure of the disk can cause the server to fail, so the disk is a single point of failure. If a single-sign-on system does not work, the entire system will be compromised. Single points of failure are eliminated through the defense-in-depth strategy. Compensating controls, alternate facilities, fallback procedures, and redundancy features are required to ensure that damage or loss resulting from a single point of failure is minimized.
Relevant Terms
Cyber Resilience
Network
Reference
7113.89
7113.90
Once system backup schedules and proper controls are in place, the disaster recovery coordinator needs to arrange, among other activities, periodic reviews of the offsite storage program and the backup computer vendor facilities. An important area to review is:
the vendor’s capacity plans.
compliance with the vendor’s financial audit requirements.
the vendor’s strategic plans.
adherence to data file or document classification criteria.
adherence to data file or document classification criteria.
The difficult aspect of a disaster recovery plan is keeping it up to date with all the changes that occur. Depending on how frequently the organization’s systems and procedures change, a review of the offsite and backup computer vendor facilities should be conducted once a quarter or semi-annually to verify that adherence to data file or document classification criteria is being met.
The other answer choices are incorrect. Generally, the review does not include whether the vendor has enough computer capacity to serve or the vendor’s strategy, which are long-term issues. The vendor’s financial audit is also not a part of such a review.
Relevant Terms
Backup
Disaster Recovery Plan
Documentation
Reference
7113.43
Reference
7113.43 Table
Rank the following benefits to be realized from a comprehensive disaster recovery plan from most to least important.
Reduced insurance costs
Enhanced physical and data security
Providing continuity of the organization’s operations
Improved protection of the organization’s assets
1, 2, 3, and 4
4, 2, 3, and 1
3, 2, 1, and 4
3, 4, 2, and 1
3, 4, 2, and 1
The correct ranking is 3, 4, 2, and 1. The most important benefit of a comprehensive disaster recovery plan is to provide (1) operations continuity, (2) protection of assets, (3) increased security, and (4) reduced insurance costs. Assets can be acquired if the business is operating and profitable.
elevant Terms
Disaster Recovery Plan
Reference
7113.40
7113.42
7113.43
Rank the following disaster recovery plan (DRP) objectives from most to least important.
Minimizing the disaster’s financial impact on the organization
Reducing physical damage to the organization’s property, equipment, and data
Limiting the extent of the damage and thus preventing an escalation of the disaster
Protecting the organization’s employees and the public
4, 2, 1, and 3
3, 2, 1, and 4
1, 2, 3, and 4
4, 3, 1, and 2
4, 3, 1, and 2
Employees’ and public health and safety should be the first concern during a disaster.
The second concern should be limiting the extent of the damage and limiting or containing the disaster.
The third concern is to minimize the disaster’s economic and financial impact on the organization regarding revenues and sales.
Finally, the fourth concern should be to reduce physical damage to property, equipment, and data.
Relevant Terms
Disaster Recovery Plan
Reference
7113.40
7113.42
Review of the audit log is an example of which of the following types of security control?
Governance
Preventive
Corrective
Detective
Detective
Detective controls detect undesired results and notify management to take corrective action. A review of the audit log is intended to find (detect) unintended results.
The other answer choices are incorrect:
Governance operates at a higher level to administer controls.
Preventive controls attempt to eliminate problems before they occur. Review of the audit log after the fact would not prevent the problem from occurring.
Corrective controls solve problems after they are discovered.
Relevant Terms
Corrective Controls
Detective Control
Preventive Controls
Reference
7113.43 Table
Strategies for processing capability are needed to recover from a disaster. Which of the following recovery strategies has the greatest chance of failure due to systems and personnel changes?
Hot site
Cold site
Redundant site
Reciprocal agreement
Reciprocal agreement
This type of agreement allows two organizations to back each other up. While this approach often sounds desirable, contingency planning experts note that this alternative has the greatest possibility of failure due to problems in keeping agreements and plans up to date as systems and personnel change.
There are many drawbacks to reciprocal or mutual aid agreements:
The agreements are difficult to enforce. The organizations might trust each other to provide support in the event of a disaster; however, disagreement may arise at the time the plan is activated.
There may be difficulty maintaining hardware and software compatibility among the cooperating organizations.
Cooperating organizations should be in relative proximity to each other. However, proximity means that both organizations may be vulnerable to the same threats.
Security and privacy concerns often prevent businesses from putting their data in the hands of other organizations, such as in the handling of healthcare or financial data.
The other answer choices are incorrect:
A hot site is a building already equipped with processing capability and has servers, workstations, and communications links ready to support critical applications.
A cold site is an empty shell facility with basic infrastructure. It includes data communication systems, security systems, air conditioning, humidity controls, raised floors, storage and office space, and electrical power.
A redundant site is a site equipped and configured exactly like the primary site.
Reference: 7113.53
One of the most important elements of the disaster recovery plan is the selection of alternate processing sites to be used when the primary sites are unavailable. Management needs to establish an optimal recovery time objective (RTO) and select an appropriate recovery alternative by comparing the business costs related to the disruption of critical processes (developed in the business impact analysis (BIA)) to the cost of the various alternative processing options.
Reference: 7113.59
Reciprocal or mutual aid agreements: In a reciprocal or mutual aid agreement, one organization agrees to provide backup and recovery facilities for another organization with a compatible hardware and software configuration and vice versa. These types of agreements may not prove workable when needed.
There are many drawbacks to reciprocal or mutual aid agreements:
The agreements are difficult to enforce. The organizations might trust each other to provide support in the event of a disaster; however, disagreement may arise at the time the plan is activated.
There may be difficulty maintaining hardware and software compatibility among the cooperating organizations.
Cooperating organizations should be in relative proximity to each other. However, proximity means that both organizations may be vulnerable to the same threats.
Security and privacy concerns often prevent businesses from putting their data in the hands of other organizations, such as in the handling of healthcare or financial data.
The best contingency plan maintenance approach to ensure the currency of the plan is to incorporate it into:
software upgrades.
hardware upgrades.
revision procedures.
change management procedures.
change management procedures.
The contingency plan will become dated as time passes and as the resources used to support critical functions change. Responsibility for keeping the contingency plan current should be specifically assigned.
hardware upgrades.
software upgrades.
revision procedures.
Contingency plan maintenance can be incorporated into procedures for change management so that upgrades to hardware and software are reflected in the plan. In addition, change management practices will handle program revision procedures.
Relevant Terms
Change Management
Contingency Plan
Reference
7113.15
7113.20
The frequency of file backups should depend primarily on the criticality of the application system:
rules.
edits.
documentation.
functions.
functions.
The frequency of file backup must depend on the criticality of the application system functions and data. Critical data should be backed up using the “grandfather-father-son” method. Backup of operating systems software and application programs must be performed whenever they are modified or updated.
The other answer choices are incorrect: Whether the application system has rules, documentation, or edits does not matter when it comes to the frequency of backup.
Relevant Terms
Backup
Reference
7113.11
The most important type of insurance policy for a computer-related disaster should cover which of the following?
Cost of computer equipment repair
Cost of building in which the computer is housed
Cost of computer equipment replacement
Cost of alternative computer processing
Cost of alternative computer processing
An insurance policy is needed that will replace the damaged equipment and cover alternative processing costs while the equipment is unavailable.
The other answer choices are incorrect. A traditional IS insurance policy covers equipment, buildings, and storage media re-creation. The policy does not provide coverage for the consequences of loss of computer equipment or its inaccessibility.
Disaster Recovery Plan
7113.38
The primary objective of disaster recovery planning is to:
minimize loss of assets.
minimize business interruption.
provide backup facilities and services.
ensure human safety.
ensure human safety.
The ultimate objective of the disaster recovery planning process is to respond to incidents that may impact people and organizations in delivering products and services to customers and meeting compliance requirements.
Human safety is the first critical objective of the disaster recovery planning process. Minimizing loss of assets, minimizing business interruption, and providing backup facilities and services are essential objectives but not the most critical objectives.
Reference: 7113.40
When a disaster occurs, the level and extent of the disaster must be immediately determined, and appropriate steps taken to safeguard lives and prevent further destruction or escalation of the disaster. Upon stabilization, a preliminary damage assessment should be conducted, and the situation evaluated.
Depending upon the level of disaster and the results of the initial damage assessment, the affected personnel and management should be notified. Based upon a full or partial recovery operation, the objective is to return to normal operation at the earliest possible time. Human safety is the most critical aspect, while restoring service is a secondary objective.
Reference: 7113.42
The ultimate objective of the disaster recovery planning process is to respond to incidents that may impact people and organizations in delivering products and services to customers and meeting compliance requirements.
Reference
7113.40
7113.42
There is a debate over how often a disaster recovery plan should be tested. The frequency of testing should depend on:
an auditor’s recommendation.
budget allowances.
IT department opinion.
the nature of data processing.
the nature of data processing.
The number of times a disaster recovery plan should be tested depends on the size, needs, and nature of the organization’s data processing. Some IT service companies perform monthly checks on their client’s backups to ensure backup continuity. The disaster recovery plan should be tested periodically.
The other answer choices are incorrect:
An auditor’s recommendations are suggestions only. A cost-benefit analysis should be performed.
Budget allowances should not dictate the frequency of disaster recovery plan testing. Testing should be done even without budgeted amounts if the risk is high.
It is too risky to leave disaster recovery plan testing to the IT department’s discretion. They may not be aware of the criticality of data processing for the overall business.
Term: Data Processing
Data processing is a sequence of steps to record, classify, and summarize data using a computer program.
Reference
7113.62
7113.63
7113.64
What is an alternate processing site that is equipped with telecommunications but not computers?
Cold site
Hot site
Redundant site
Warm site
Warm site
A warm site has telecommunications ready to be utilized and has partially configured IT infrastructure with network connections and essential peripheral equipment such as disk drives.
The other answer choices are incorrect:
A cold site is an empty shell facility equipped with environmental controls (e.g., heat, air conditioning) and electrical power.
A hot site is a fully equipped facility ready to operate quickly.
A redundant site is configured exactly like the primary site.
Reference: 7113.57
Warm site: A warm site lies in between a hot site and a cold site. A warm site has telecommunications ready to be utilized and is recommended for users of sophisticated telecommunications and network needs. A warm site has partially configured IT infrastructure with network connections and essential peripheral equipment such as disk drives. They always contain the necessary equipment and data circuits necessary to rapidly establish operations.
What is the greatest risk in the practice of data file backup using the traditional backup approach?
File backups are forgotten occasionally.
A third-party courier may not comply with the transportation schedule.
Wrong tapes or cartridges are returned occasionally from offsite storage.
Everything that should be in offsite storage is not there.
Everything that should be in offsite storage is not there.
If everything that should be in offsite storage is not there, it defeats the entire backup objective. This situation does not help test application systems at the backup facility during a simulation or real disaster.
The other answer choices are incorrect: Although they are also risks, their severity levels are less than the correct answer choice. They are normal errors or omissions. They can be corrected with checklist assessments, automation, or quality reviews.
Data Backup Storage
Reference
7113.03
7113.04
What is the inherent limitation of a disaster recovery planning exercise?
Conducting periodic drills
Assembling disaster management and recovery teams
Developing early warning monitors that will trigger alerts and responses
The inability to include all types of disasters
The inability to include all types of disasters
Correct
The correct answer is “the inability to include all types of disasters.” Since many types of disasters can occur, it is not practical to consider all disasters. Furthermore, doing so would be cost prohibitive. Hence, disaster recovery planning exercises should focus on the types of disasters that occur frequently.
Risk analysis is a complete and meaningful disaster recovery planning program prerequisite. Risk analysis assesses threats to resources (assets). It determines the amount of protection necessary to adequately safeguard the resources (assets) so that vital systems, operations, and services can be quickly resumed to a normal status in a disaster.
The other answer choices are incorrect as they are important aspects of a disaster recovery planning exercise: assembling disaster management and recovery teams, developing early warning monitors that will trigger alerts and responses, and conducting periodic drills.
Relevant Terms
Disaster Recovery Plan
Risk Analysis
Reference
7113.18
7113.35
7113.36
What is the primary disadvantage of using a cold site as a disaster recovery site?
Cold site compilers may not have adequate processing capacity.
Existing equipment or software at the site may not be compatible.
Frequent upgrades to equipment and software increase costs.
Delivery of equipment and software may be delayed.
Delivery of equipment and software may be delayed.
As an alternative backup location, a cold site has everything needed (power, air conditioning, and support systems) to quickly install a computer. Cold site users rely on their computer vendors for prompt delivery of equipment and software if an emergency occurs. Time will be needed to deliver the equipment and software, which may impact operations and the timeliness of restoration.
Frequent upgrades to equipment and software increase costs.
“Frequent upgrades to equipment and software increase costs” is not a main disadvantage of a cold site but may apply to other disaster recovery solutions, like hot sites or warm sites, where the equipment and software are maintained.
Cold site compilers may not have adequate processing capacity.
“Cold site compilers may not have adequate processing capacity” is not the primary disadvantage of a cold site. Organizations usually assess the capacity and capabilities of a cold site before selecting it as a disaster recovery option.
Existing equipment or software at the site may not be compatible.
“Existing equipment or software at the site may not be compatible” is a concern but is also not the primary disadvantage of a cold site. Compatibility issues can usually be addressed through proper planning and testing.
Relevant Terms
Cold Site
Disaster Recovery Plan
Reference
7113.38
7113.56
What should be the last step in a risk assessment process performed as part of a business continuity plan?
Consider possible threats
Evaluate critical needs
Assess potential impacts
Establish recovery priorities
Establish recovery priorities
“Establish recovery priorities” is the last step in the risk assessment process for a BCP (business continuity plan). The correct sequence is:
Consider possible threats
Assess potential impacts
Evaluate critical needs
Establish recovery priorities
The first step is to consider possible threats, which include natural (e.g., fires, floods, and earthquakes), technical (e.g., hardware/software failure, power disruption, and communications interference), and human (e.g., riots, strikes, disgruntled employees, and sabotage) threats.
The second step is to assess the impacts of the loss of information and services from internal and external sources. This includes impacts on financial conditions, competitive position, customer confidence, legal/regulatory requirements, and cost analysis needed to minimize exposure.
The third step is to evaluate critical needs. This evaluation should also consider time frames in which a specific function becomes critical. This includes functional operations, key personnel, information, processing systems, documentation, vital records, and policies and procedures.
The fourth and final step is to establish priorities for recovery based on critical needs.
Relevant Terms
Business Continuity Plan (BCP)
Risk Assessment
Reference
7113.44
7113.50
