Business Resilience 2

Question 1

What does a lower recovery time objective equate to?

Answer 1

Higher Costs

How? - Because RTO is based on the acceptable down time in case of a disruption of operations

Question 2

What should the IS auditor review first to determine why the performance of the disaster recovery site’s server is slow?

Answer 2

Configurations and alignment of the primary and disaster recovery sites

Question 3

What type of risk approach is being used when an organization enters into a disaster recovery plan reciprocal agreement?

Answer 3

Risk Mitigation

i.e. a reciprocal agreement in which two organizations agree to provide computing resources to each other in the event of a disaster is a form of risk mitigation.

Question 4

Which group within an organization would be the best source of information for determining the criticality of application systems as part of a business impact analysis (BIA)?

Answer 4

The Business Process Owners’

Why? - Because the BIA is designed to evaluate criticality and recovery time lines, based on business needs.

Question 5

What should an organization do after completing a business impact analysis as part of business continuity planning?

Answer 5

A business continuity strategy

which identifies the best way to recover

Question 6

How can a business ensure their business continuity plan remains up to date?

Answer 6

A group walkthrough of the different scenarios of the plan from beginning to end

Question 7

What is the primary purpose of a business impact analysis?

Answer 7

To define recovery strategies

i.e. The recovery time objective and the recovery point objective

Question 8

In a scenario with multiple applications hosted on one server what is the recovery time objective based on?

Answer 8

The application with the shortest RTO

i.e. the server’s RTO must be determined by taking the RTO of the most critical application, which is the shortest RTO

Question 9

What key phrases best help define disaster recovery strategies?

Answer 9

Maximum tolerable downtime and data loss

Question 10

What business continuity plan test involves participation of relevant members of the crisis management/response team (For proper coordination)?

Answer 10

Tabletop

i.e. This testing practices proper coordination because it involves all or some of the crisis team members

Question 11

How can a company ensure a structured disaster recovery?

Answer 11

By making sure the business continuity plan and disaster recovery plan are tested regularly

Question 12

What is a great indicator of the effectiveness of backup and restore procedures while restoring data after a disaster?

Answer 12

Recovery time objectives were met

Question 13

True or False.

Recovery procedures for an information processing facility are best based on recovery point objective.

Answer 13

FALSE.

Recovery procedures for an information processing facility are best based on:

• recovery time objective (i.e. the amount of time allowed for the recovery of a business function or resource after a disaster occurs)

Question 14

What is a key indicator that shows that the disaster recovery procedures meets a data center requirements?

Answer 14

A tabletop exercise using the procedures was conducted

i.e. This tabletop exercise (paper-based test) best ensures that the procedures meet the requirements

Question 15

What measure mitigates the risk arising from using reciprocal agreements as a recovery alternative?

Answer 15

Ensuring that partnering organizations are separated geographically.

Question 16

What is a method to best ensures that critical IT system failures do not recur?

Answer 16

Perform root cause analysis

This allows for appropriate corrections that will help prevent the incident from recurring

Question 17

What would be a good reason for integrating the testing of noncritical systems in disaster recovery plans (DRPs) with business continuity plans (BCPs)?

Answer 17

BCPs may assume the existence of capabilities that are not in DRPs

Question 18

What is the primary concern when determining the service delivery objective?

Answer 18

The minimum acceptable operational capability

Question 19

What is the result of segmenting a highly sensitive database?

Answer 19

Reduced Exposure

i.e. It reduces the quantity of data exposed to a particular vulnerability