Business Resilience

Question 1

What does applying a retention date on a file ensure?

Answer 1

That data will not be deleted before that date

i.e. A retention date will ensure that a file cannot be overwritten or deleted before that date has passed.

Question 2

What would be the BEST cost-effective test of the disaster recovery plan (for offices across a wide geographical area)?

Answer 2

A Preparedness test

i.e. This is performed by each local office/area to test the adequacy of the preparedness of local operations for disaster recovery.

Question 3

What type of offsite information processing facility has electrical wiring, air conditioning and flooring, but no computer or communications equipment?

Answer 3

A Cold site

Why? - Because it is ready to receive equipment but does not offer any components at the site in advance of the need.

Question 4

True or False.

Disaster recovery planning addresses the operational part of business continuity planning (BCP).

Answer 4

FALSE.

Disaster recovery planning addresses the technological part of BCP.

i.e. The focus is on IT systems and operations.

Question 5

What practice would ensure the availability of transactions in the event of a disaster?

Answer 5

Transmitting transactions offsite in real time.

Question 6

What is the method of routing traffic through split cable or duplicate cable facilities called?

Answer 6

Diverse Routing (which routes traffic through split-cable facilities or duplicate-cable facilities)

Note: This type of access is time consuming and costly.

Question 7

What happens if the recovery time objective increases?

Answer 7

The disaster tolerance increases (I.e. The longer the recovery time objective (RTO), the higher disaster tolerance)

Note: The disaster tolerance is the amount of time the business can afford to be disrupted before resuming critical operations.

Question 8

True or False.

If the recovery time objective increases, the cost of recovery increases.

Answer 8

FALSE.

The longer the RTO, the lower the recovery cost

Question 9

What is the primary objective of a Business Continuity Plan?

Answer 9

To identify limitations of the business continuity plan

Question 10

What would be considered an appropriate method of transfer/backup in design of a business continuity plan for an airline reservation system?

Answer 10

Shadow file processing

i.e. exact duplicates of the files are maintained at the same site or at a remote site. The two files are processed concurrently.

Question 11

What is considered the most appropriate test method to apply to a business continuity plan?

Answer 11

A Paper test (sometimes called a deskcheck)

i.e. It is a walk-through of the entire BCP, or part of the BCP, involving major players in the BCP’s execution

Question 12

What is the next step in a business continuity planning process after completing an business impact analysis (BIA)?

Answer 12

Developing recovery strategies.

i.e. determining the most appropriate strategy for recovering from a disaster that will meet the time lines and priorities defined through the BIA.

Question 13

What would be considered a continuity plan test that simulates a system crash and uses actual resources to cost-effectively obtain evidence about the plan’s effectiveness?

Answer 13

Preparedness Test

This is a localized version of a full test, wherein resources are expended in the simulation of a system crash.

Question 14

What would be considered an appropriate method for assessing the effectiveness of a business continuity plan?

Answer 14

Reviewing the results from previous tests

i.e. Previous test results will provide evidence of the effectiveness of the business continuity plan

Question 15

What frequently updated information is key to the continued effectiveness of a disaster recovery plan?

Answer 15

Contact information of key personnel

Why? - Because in the event of a disaster, it is important to have a current updated list of personnel who are key to the operation of the plan

Question 16

What should the activation of an enterprise’s business continuity plan be based on?

Answer 16

The predetermined duration of the outage

i.e. the maximum period for which a business function can be disrupted before the disruption threatens the achievement of organizational objectives

Question 17

What should the next step be to verify the adequacy of the new BCP (after a table top test is performed)?

Answer 17

A functional test of a scenario with limited IT involvement

NOTE: The full-scale test would be the last step of the verification process before entering into a regular annual testing schedule

Question 18

What is of great concern (i.e. a huge risk) if the storage growth in a critical file server is not managed properly?

Answer 18

Server recovery work may not meet the recovery time objective

i.e. If the recovery cannot meet the recovery time objective (RTO), there will be a discrepancy in IT strategies

Question 19

What would integrating the business continuity plan into IT project management do?

Answer 19

Aid in the development of a more comprehensive set of requirements

i.e. this ensures complete coverage of the requirements through each phase of the project

Question 20

Why should an IS auditor recommend a business impact analysis to optimize an organization’s business continuity plan?

Answer 20

To determine the business processes that must be recovered following a disaster to ensure the organization’s survival