Business Continuity Planning Flashcards

1
Q

Which of the following could lead to the conclusion that a disaster recovery plan may not be operational within the timeframe the business needs to recover?
A. )The alternate site is a warm site
B. Critical recovery priority levels are not defined
C. Offsite backups are located away from the alternate site
D. The alternate site is located 70 miles away from the primary site

A

Answer: B
Explanation:

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the four domains of communication in the disaster planning and recovery process?
A. Plan manual, plan communication, primer for survival, warning and alarms
B. Plan communication, primer for survival, escalation, declaration
C. Plan manual, warning and alarm, declaration, primer for survival
D. Primer for survival, escalation, plan communication, warning and alarm

A

Answer: C
Explanation:

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

The underlying reason for creating a disaster planning and recover strategy is to
A. Mitigate risks associated with disaster.
B. Enable a business to continue functioning without impact.
C. Protect the organization’s people, place and processes.
D. Minimize financial profile.

A

Answer: A
Explanation: “Disaster recovery has the goal of minimizing the effects of a disaster and taking the necessary steps to ensure that the resources, personnel, and business processes are able to resume operation in a timely manner.” Pg 550 Shon Harris: All-in-One CISSP Certification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Which of the following is not a direct benefit of successful Disaster Recovery Planning?
A. Maintain Nance of Business Continuity
B. Protection of Critical Data
C. Increase in IS performance
D. Minimized Impact of a disaster

A

Answer: C
Explanation:

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q
Organizations should not view disaster recovery as which of the following?  
A. committed expense 
B. discretionary expense 
C. enforcement of legal statues 
D. compliance with regulations
A

Answer: B
Explanation:

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Which of the following statements pertaining to disaster recovery is incorrect?
A. A recovery team’s primary task is to get the pre-defined critical business functions at the alternate backup processing site.
B. A salvage team’s task is to ensure that the primary site returns to normal processing conditions
C. The disaster recovery plan should include how the company will return from the alternate site to the primary site
D. When returning to the primary site, the most critical applications should be brought back first

A

Answer: D
Explanation:

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Which of the following statements pertaining to dealing with the media after a disaster occurred and disturbed the organization’s activities is incorrect?
A. The CEO should always be the spokesperson for the company during a disaster
B. The disaster recovery plan must include how the media is to be handled during the disaster
C. The organization’s spokesperson should report bad news before the press gets ahold of it through another channel
D. An emergency press conference site should be planned ahead

A

Answer: A
Explanation:

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is a disaster recovery plan for a company’s computer system usually focused on?
A. Alternative procedures to process transactions
B. The probability that a disaster will occur C. Strategic long-range planning
D. Availability of compatible equipment at a hot site

A

Answer: A
Explanation:

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the most critical piece to disaster recovery and continuity planning?
A. Security Policy
B. Management Support
C. Availability of backup information processing facilities
D. Staff training

A

Answer: B Explanation:

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Which of the following is the most important consideration in locating an alternate computing facility during the development of a disaster recovery plan?
A. it is unlikely to be affected by the same contingency
B. it is close enough to become operation quickly
C. is it close enough to serve it’s users
D. it is convenient to airports and hotels

A

Answer: A
Explanation:

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Which of the following are PRIMARY elements that are required when designing a Disaster Recovery Plan (DRP)?
A. Back-up procedures, off-site storage, and data recover.
B. Steering committee, emergency response team, and reconstruction team.
C. Impact assessment, recover strategy, and testing.
D. Insurance coverage, alternate site, and manual procedures.

A

Answer: C
Explanation: The most critical piece to disaster recovery and continuity planning is management support. They must be convinced of its necessity. Therefore, a business case must be made to obtain this support. The business case can include current vulnerabilities, regulatory and legal obligations, current status of recovery plans, and recommendations. Management will mostly concerned with cost/benefit issues, so several preliminary numbers will need to be gathered and potential losses estimated. - Shon Harris All-in-one CISSP Certification Guide pg 595 There are four major elements of the BCP process Scope and Plan Initiation - this phase marks the beginning of the BCP process. IT entails creating
ISC CISSP Exam
“Pass Any Exam. Any Time.” - www.actualtests.com 468
the scope and other elements needed to define the parameters of the plan. Business Impact Assessment - A BIA is a process used to help business units understand the impact of a disruptive event. This phase includes the execution of a vulnerability assessment Business Continuity Plan Development - This term refers to using the information collection in the BIA to develop the actual business continuity plan. This process includes the areas of plan implementation, plan testing, and ongoing plan maintenance. Plan Approval and Implementation - This process involves getting the final senior management signoff, creating enterprise-wide awareness of the plan, and implementing a maintenance procedure for updating the plan as needed. -Ronald Krutz The CISSP PREP Guide (gold edition) pg 380-381

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Emergency actions are taken at the incipient stage of a disaster with the objectives of preventing injuries or loss of life and of:
A. determining the extent of property damage
B. protecting evidence
C. preventing looting and further damage
D. mitigating the damage to avoid the need for recovery

A

Answer: D
Explanation:

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q
Who should direct short-term recovery actions immediately following a disaster?  
A. Chief Information Officer 
B. Chief Operating Officer 
C. Disaster Recovery Manager 
D. Chief Executive Officer
A

Answer: C
Explanation:

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q
The environment that must be protected includes all personnel, equipment, data, communication devices, power supply and wiring. The necessary level of protection depends on the value of data, the computer systems, and the company assets within the facility. The value of these items can be determined by what type of analysis?  
A. Critical-channel analysis 
B. Critical-route analysis 
C. Critical-path analysis 
D. Critical-conduit analysis
A

Answer: C
Explanation: “The environment that must be protected through physical security controls includes all personnel, equipment, data, communication devices, power supplies, and wiring. The necessary level of protection depends on the value of the data, the computer systems, and the company assets within the facility. The value of these items can be determined by a critical-path analysis, which lists each piece of the infrastructure and what is necessary to keep those pieces healthy and operational.” Pg 255 Shon Harris: All-in-One CISSP Certification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Which of the following steps should be performed first in a business impact analysis (BIA)?
A. Identify all business units within the organization
B. Evaluate the impact of the disruptive events
C. Estimate the Recovery Time Objectives (RTO)
D. Evaluate the criticality of business functions

A

Answer: A
Explanation:

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Which of the following steps is NOT one of the four steps of a Business Impact Analysis (BIA)?
A. Notifying senior management
B. Gathering the needed assessment materials
C. Performing the vulnerability assessment
D. Analyzing the information compiled

A

Answer: A
Explanation: “A BIA generally takes the form of these four steps:
Pg. 383 Krutz: CISSP Prep Guide: Gold Edition.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q
What methodology is commonly used in Business Continuity Program?    
A. Work Group Recovery 
B. Business Impact Analysis 
C. Qualitative Risk Analysis 
D. Quantitative Risk Analysis
A

Answer: B
Explanation: A BIA is performed at the beginning of disaster recovery and continuity planning to identify the areas that would suffer the greatest financial or operational loss in the event of a disaster or disruption. It identifies the company’s critical systems needed for survival and estimates the outage time that can be tolerated by the company as a result of disaster or disruption. - Shon Harris All-in-one CISSP Certification Guide pg 597

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Which of the following steps should be performed first in a business impact analysis (BIA)?
A. Identify all business units within an organization
B. Evaluate the impact of disruptive events
C. Estimate the Recovery Time Objectives (RTO)
D. Evaluate the criticality of business functions

A

Answer: A
Explanation: “The initial step of the BIA is identifying which business units are critical to continuing an acceptable level of operations.” Pg 383 Krutz: CISSP Prep Guide: Gold Edition.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Which is not one of the primary goals of BIA?
A. Criticality Prioritization
B. Down time estimation
C. Determining requirements for critical business functions
D. Deciding on various test to be performed to validate Business Continuity Plan

A

Answer: D
Explanation:

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q
Which of the following is used to help business units understand the impact of a disruptive event?  
A. A risk analysis 
B. A Business Impact assessment 
C. A Vulnerability assessment 
D. A disaster recovery plan
A

Answer: B
Reference: “The purpose of a BIA is to create a document to be used to help understand what impact a disruptive event would have on the business.” Pg 383 Krutz : CISSP Prep Guide: Gold Edition

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

A Business Impact Analysis (BIA) does not:
A. Recommend the appropriate recovery solution
B. Determine critical and necessary business functions and their resource dependencies
C. Identify critical computer applications and the associated outage tolerance
D. Estimate the financial and operation impact of a disruption

A

Answer: A
Explanation:

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q
What assesses potential loss that could be caused by a disaster? 
A. The Business Assessment (BA) 
B. The Business Impact Analysis (BIA) 
C. The Risk Assessment (RA) 
D. The Business Continuity Plan (BCP)
A

Answer: B
Explanation:

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

During the course of a Business Impact Analysis (BIA) you will less likely:
A. Estimate the financial and operational impact of a disruption
B. Identify regulatory exposure
C. Determine if functions Recovery Time Objective (RTO)
D. Determine the impact upon the organizations market share and corporate image

A

Answer: C
Explanation:

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Which of the following tasks is not usually part of a Business Impact Analysis (BIA)?
A. Identify the type and quantity of resources required for recovery
B. Identify the critical processes and the dependencies between them
C. Identify organizational risks
D. Develop a mission statement

A

Answer: D
Explanation:

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Which of the following will a Business Impact Analysis (BIA) NOT identify?
A. Areas that would suffer the greatest financial or operation loss in the event of a disaster
B. Systems critical to the survival of the enterprise
C. The names of individuals to be contacted during a disaster
D. The outage time that can be tolerated by the enterprise as a result of a disaster

A

Answer: C
Explanation:

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Which one the following is the primary goal of Business Continuity Planning?
A. Sustain the organization.
B. Recover from a major data center outage.
C. Test the ability to prevent major outages.
D. Satisfy audit requirements.

A

Answer: A
Explanation: Simply put, business continuity plans are created to prevent interruptions to normal business activity. -Ronald Krutz The CISSP PREP Guide (gold edition) pg 378

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q
Most of unplanned downtime of information systems is attributed to which of the following?  
A. Hardware failure 
B. Natural disaster 
C. Human error 
D. Software failure
A

Answer: A
Explanation:

28
Q
System reliability s increased by:  
A. A lower MTBF and a lower MTTR 
B. A higher MTBF and a lower MTTR 
C. A lower MTBF and a higher MTTR 
D. A higher MTBF and a higher MTTR
A

Answer: B
Explanation: One prefers to have a higher MTBF and a lower MTTR.
“Each device has a mean time between failure (MTBF) and a mean time to repair (MTTR). The MTBF estimate is used to determine the expected lifetime of a device or when an element within that device is expected to give out. The MTTR value is used to estimate the time it will take to repair the device and get it back into production.” Pg 267 Shon Harris: All-in-One CISSP Certification

29
Q
Which of the following is NOT a major element of Business Continuity Planning?  
A. Creation of a BCP committee 
B. Business Impact Assessment (BIA) 
C. Business Continuity Plan Development 
D. Scope plan initiation
A

Answer: A
Explanation:

30
Q

Which one of the following is a core infrastructure and service element of Business Continuity Planning (BCP) required to effectively support the business processes of an organization?
A. Internal and external support functions.
B. The change management process.
C. The risk management process.
D. Backup and restoration functions.

A

Answer: C
Explanation: Pg 383 Krutz Gold Edition. Backup is not BCP.

31
Q
A business continuity plan should list and prioritize the services that need to be brought back after a disaster strikes. Which of the following services is more likely to be of primary concern?  
A. Marketing/Public relations 
B. Data/Telecomm/IS facilities 
C. IS Operations 
D. Facilities security
A

Answer: B
Explanation:

32
Q
When preparing a business continuity plan, who of the following is responsible for identifying and prioritizing time-critical systems?  
A. Executive management staff 
B. Senior business unit management 
C. BCP committee 
D. Functional business units
A

Answer: B
Explanation:

33
Q
Classification of information systems is essential in business continuity planning. Which of the following system types can not be replaced by manual methods?  
A. Critical System 
B. Vital System 
C. Sensitive System 
D. Non-critical system
A

Answer: A
Explanation:

34
Q
A business continuity plan should list and prioritize the services that need to be brought back after a disaster strikes. Which of the following services is more likely to be of primary concern?  
A. Marketing/Public Relations 
B. Data/Telecomm/IS facilities 
C. IS Operations 
D. Facilities security
A

Answer: B
Explanation:

35
Q
Business Continuity Plan development depends most on:
A. Directives of Senior Management 
B. Business Impact Analysis (BIA) 
C. Scope and Plan Initiation 
D. Skills of BCP committee
A

Answer: B
Explanation:

36
Q
Which primary element of BCP includes carrying out vulnerability analysis?  
A. Scope and Plan Initiation 
B. Business Impact Assessment 
C. Business Continuity Plan Development 
D. Plan Approval and Implementation
A

Answer: B
Explanation:

37
Q

To mitigate the impact of a software vendor going out of business, a company that uses vendor software should require which one of the following?
A. Detailed credit investigation prior to acquisition.
B. Source code held in escrow.
C. Standby contracts with other vendors.
D. Substantial penalties for breech of contract.’

A

Answer: B
Explanation: The original answer was C however this is incorrect for this case. SLA and standby are good ideas but in this case B is right. “A software escrow arrangement is a unique tool used to protect a company against the failure of a software developer to provide adequate support for its products or against the possibility that the developer will go out of business and no technical support will be available for the product….Under a software escrow agreement, the developer provides copies of the application source code to an independent third-party organization. The third party then maintains updated backup copies of the source code in a secure fashion. The agreement between the end user and the developer specifies “trigger events”, such as the failure of the developer to meet terms of a service level agreement (SLA) or the liquidation of the developer’s firm.” - Ed Tittle CISSP Study Guide (sybex) pg 550

38
Q

Similarity between all recovery plans is:
A. They need extensive testing
B. They need to be developed by business continuity experts
C. They become obsolete quickly
D. The create employment opportunities

A

Answer: C
Explanation:

39
Q
Which of the following focuses on sustaining an organizations business functions during and after a disruption?  
A. Business continuity plan 
B. Business recovery plan 
C. Continuity of operations plan 
D. Disaster recovery plan
A

Answer: A
Explanation:

40
Q

What is not one of the drawbacks of a hot site?
A. Need Security controls, as it usually contain mirror copies of live production data
B. Full redundancy in hardware, software, communication lines, and applications lines is very expensive
C. The hot sites are available immediately or within maximum allowable downtime (MTD)
D. They are administratively resource intensive, as transaction redundancy controls need to be implemented to keep data up-to-date

A

Answer: C
Explanation:

41
Q
Which one of the following processing alternatives involves a ready-to-use computing facility with telecommunications equipment, but not computers?   
A. Company-owned hot site 
B. Commercial hot site 
C. Cold site 
D. Warm site
A

Answer: D
Explanation: “Warm Site - These facilities are usually partially configured with some equipment, but not the actual computers.” - Shon Harris All-in-one CISSP Certification Guide pg 613

42
Q

What is a hot-site facility?
A. A site with pre-installed computers, raised flooring, air conditioning, telecommunications, and networking equipment, and UPS
B. A site is which space is reserved with pre-installed wiring and raised floors
C. A site with raised flooring, air conditioning, telecommunications, and networking equipment, and UPS
D. A site with ready made work space with telecommunications equipment, LANs, PCs, and terminals with work groups

A

Answer: A
Explanation:

43
Q
Contracts and agreements are unenforceable in which of the following alternate back facilities?  
A. hot site 
B. warm site 
C. cold site 
D. reciprocal agreement
A

Answer:

D Explanation:

44
Q
Which of the following computer recovery sites is the least expensive and the most difficulty to test?  
A. non-mobile hot site 
B. mobile hot site 
C. warm site 
D. cold site
A

Answer: D
Explanation:

45
Q

Which of the following is an advantage of the use of hot sites as a backup alternative?
A. The costs associated with hot sites are low
B. Hot sites can be made ready for operation within a short period of time
C. Hot sites can be used for an extended amount of time
D. Hot sites do not require that equipment and systems software be compatible with the primary installation being backed up

A

Answer: B
Explanation:

46
Q

What is not a benefit of Cold Sites?
A. No resource contention with other organization
B. Quick Recovery
C. Geographical location that is not affected by the same disaster
D. low cost

A

Answer:

B Explanation:

47
Q

What is the PRIMARY reason that reciprocal agreements between independent organizations for backup processing capability are seldom used?
A. Lack of successful recoveries using reciprocal agreements.
B. Legal liability of the host site in the event that the recovery fails.
C. Dissimilar equipment used by disaster recovery organization members.
D. Difficulty in enforcing the reciprocal agreement.

A

Answer: D
Explanation: “Reciprocal agreements are at best a secondary option for disaster protection. The agreements are not enforceable, so there is no guarantee that this facility will really be available to the company in a time of need.” Pg 615 Shon Harris CISSP All-In-One Certification Exam Guide

48
Q

Which of the following alternative business recovery strategies would be LEAST appropriate in a large database and on-line communications network environment where the critical business continuity period is 7 days?
A. Hot site
B. Warm site
C. Duplicate information processing facilities
D. Reciprocal agreement

A

Answer: D
Explanation:

49
Q
A contingency plan should address:  
A. Potential risks 
B. Residual risks 
C. Identified risks 
D. All of the above
A

Answer: B
Explanation:

50
Q

Prior to a live disaster test, which of the following is most important?
A. Restore all files in preparation for the test
B. Document expected findings
C. Arrange physical security for the test site
D. Conduct a successful structured walk-through

A

Answer: D
Explanation:

51
Q

Which of the following business continuity stages ensures the continuity strategy remains visible?
A. Backup, Recover and Restoration
B. Testing Strategy Development
C. Post Recovery Transition Data Development
D. Implementation, Testing and Maintenance

A

Answer: D
Explanation: Once the strategies have been decided upon, they need to be documented and put into place. This moves the efforts from a purely planning stage to an actual implementation and action phase…The disaster recovery and continuity plan should be tested periodically because an environment continually changes and each time it is tested, more improvements may be uncovered…The plan’s maintenance can be incorporated into change management procedures so that any changes in the environment will be sure to be reflected in the plan itself. - Shon Harris Allin-one CISSP Certification Guide pg 611

52
Q

During the testing of the business continuity plan (BCP), which of the following methods of results analysis provides the BEST assurance that the plan is workable?
A. Measurement of accuracy
B. Elapsed time for completion of critical tasks
C. Quantitatively measuring the results of the test
D. Evaluation of the observed test results

A

Answer: C
Explanation:

53
Q

Which of the following recovery plan test results would be most useful to management?
A. elapsed time to perform various activities
B. list of successful and unsuccessful activities
C. amount of work completed
D. description of each activity

A

Answer: B
Explanation:

54
Q
Failure of a contingency plan is usually:  
A. A technical failure 
B. A management failure 
C. Because of a lack of awareness 
D. Because of a lack of training
A

Answer: B
Explanation:

55
Q
The first step in contingency planning is to perform:  
A. A hardware backup 
B. A data backup 
C. An operating system software backup 
D. An application software backup
A

Answer: B
Explanation:

56
Q

Which of the following server contingency solutions offers the highest availability?
A. System backups
B. Electronic vaulting/remote journaling
C. Redundant arrays of independent disks (RAID)
D. Load balancing/disk replication

A

Answer: D
Explanation:

57
Q

Which of the following statement pertaining to the maintenance of an IT contingency plan is incorrect?
A. The plan should be reviewed at least once a year for accuracy and completeness
B. The Contingency Planning Coordinator should make sure that every employee gets an up-todate copy of the plan
C. Strict version control should be maintained
D. Copies of the plan should be provided to recovery personnel for storage at home and office

A

Answer: B
Explanation:

58
Q
Which disaster recovery plan test involves functional representatives meeting to review the plan in detail?  
A. Simulation test 
B. Checklist test 
C. Parallel test 
D. Structured walkthrough test
A

Answer: D
Explanation: “Structured walk-through:
Pg 699 Hansche: Official (ISC)2 Guide to the CISSP Exam

59
Q

What is the MAIN purpose of periodically testing off-site hardware backup facilities?
A. To eliminate the need to develop detailed contingency plans
B. To ensure that program and system documentation remains current
C. To ensure the integrity of the data in the database
D. To ensure the continued compatibility of the contingency facilities

A

Answer: D
Explanation:

60
Q

Scheduled tests of application contingency plans should be based on the
A. Size and complexity of the application.
B. Number of changes to the application.
C. Criticality of the application.
D. Reliability of the application.

A

Answer: C
Explanation:

61
Q

Which of the following is less likely to accompany a contingency plan, either within the plan itself or in the form of an appendix?
A. Contact information for all personnel B. Vendor contract information, including offsite storage and alternate site C. Equipment ad system requirements lists of hardware, software, firmware, and other resources required to support system operations D. The Business Impact Analysis
Answer: D Explanation: You use the BIA as a guideline to create the contingency plan.

A

Answer: C
Explanation: Time sensitivity and mission criticality in conjunction with budgetary limitations, level of threat and degree of risk will be major factors in the development of recommended strategies Reference:
http://csrc.nist.gov/groups/SMA/fasp/documents/contingency_planning/contingencyplantemplate.doc
Note:
All though not directly answering the question a little inference lead to this
“Priorities - It is extremely important to know what is critical versus nice to have… It is necessary to know which department must come online first, which second, and so on…It maybe more necessary to ensure that the database is up and running before working to bring the file server online.” - Shon Harris All-in-one CISSP Certification Guide pg 604

62
Q
The first step in contingency planning is to perform:  
A. A hardware backup 
B. A data backup 
C. An operating system software backup 
D. An application software backup
A

Answer: B

Explanation

63
Q
Which of the following teams should not be included in an organization’s contingency plan?  
A. Damage assessment team 
B. Hardware salvage team 
C. Tiger team 
D. Legal affairs team
A

Answer: C
Explanation: Tiger is an algorithm Excerpt is from CISSP / Shon Harris / 5th edition.

64
Q
Which of the following contains references to expected business continuity planning (BCP) practices that organizations must implement
A. ISO 17799:2008, Section 1
B. ISO 27005:2008, Section 8
C. ISO 27002:2005, Section 10
D. ISO 27001:2005, Annex A
A

Answer: D

Explanation

65
Q
What process identifies the business continuity requirements for the organization's assets?
A. risk analysis
B. business impact analysis
C. threat analysis
D. asset classification
A

Answer: B

Explanation

66
Q
A contingency plans should be written to
A. address all possible risk scenarios
B. address all likely risk scenarios
C. remediate all vulnerabilities
D. recover all operations
A

Answer: B

Explanation