A company has two critical systems: the order processing system (OPS) and the customer database (CDB). The OPS has an RTO of 1 hour and an RPO of 5 minutes. The CDB has an RTO of 4 hours and an RPO of 1 hour. Both systems were affected by a ransomware attack. The recovery team has limited resources and can only restore one system at a time. Which system should be restored first?

Restore the CDB first because it has a longer RTO, giving more time to restore it later.

Restore the CDB first because it contains customer data, which is more sensitive.

Restore the OPS first because it has a shorter RTO and RPO, indicating higher business priority.

Restore both systems simultaneously to minimize overall downtime.

A company is recovering from a data breach that affected customer data. The recovery team is restoring systems, and the CEO wants regular updates on progress. The legal department also needs to know when systems are back online to assess regulatory reporting obligations. What is the best way to handle communication during the recovery?

Let the recovery team lead communicate directly with the CEO and legal only when major milestones are reached.

Provide a single update to the CEO and legal department after all systems are restored.

Send daily email updates to all employees, including the CEO and legal department.

Establish a communication plan that defines the frequency and content of updates for the CEO, legal, and other stakeholders.

What does the Recovery Time Objective (RTO) define in an incident recovery plan?

The maximum acceptable amount of data loss measured in time

The maximum acceptable downtime before systems must be restored

The time required to test the recovery plan

The time it takes to detect an incident

Dell NIST Cybersecurity Framework v2.0

Domain 7Objective 2

Analyze the Significance of Incident Recovery Plan Execution and Associated Security Controls in the RECOVER Function. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 6)

Part of the NIST Framework: RECOVER Function domain, which accounts for 7% of the NIST-CYBERSECURITY-FRAMEWORK-2 exam.

28questions here

6free pages

8concepts

7%of the exam

Questions 26–28

26expert · hard
A company has two critical systems: the order processing system (OPS) and the customer database (CDB). The OPS has an RTO of 1 hour and an RPO of 5 minutes. The CDB has an RTO of 4 hours and an RPO of 1 hour. Both systems were affected by a ransomware attack. The recovery team has limited resources and can only restore one system at a time. Which system should be restored first?
Select an answer first
27application · medium
A company is recovering from a data breach that affected customer data. The recovery team is restoring systems, and the CEO wants regular updates on progress. The legal department also needs to know when systems are back online to assess regulatory reporting obligations. What is the best way to handle communication during the recovery?
Select an answer first
28foundation · easy
What does the Recovery Time Objective (RTO) define in an incident recovery plan?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to NIST-CYBERSECURITY-FRAMEWORK-2

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Dell Technologies. “NIST-CYBERSECURITY-FRAMEWORK-2” is a trademark of its owner, used for identification only.

Analyze the Significance of Incident Recovery Plan Execution and Associated Security Controls in the RECOVER Function. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 6)

Questions 26–28

What does the Recovery Time Objective (RTO) define in an incident recovery plan?

Keep studying — NIST Framework: RECOVER Function