Business Continuity and Disaster Recovery CCT Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is the main purpose of a business impact analysis (BIA)?

   • ATo assign recovery teams to specific roles
   • BTo identify the financial and operational impacts of a disruption on critical business functions
   • CTo implement security controls to prevent cyber attacks
   • DTo test the effectiveness of the disaster recovery plan
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A hospital's patient admission system is identified as a critical function in the business impact analysis (BIA). The BIA shows that the system depends on the hospital's Active Directory for authentication and on a third-party lab results interface. The risk assessment identifies a regional power grid failure as a high-probability threat. The hospital's current recovery plan has an RTO of 4 hours for the admission system. During a recent risk review, the hospital's leadership asks what the BIA should primarily inform. Which of the following is the most direct use of the BIA in this context?

   • ACalculating the exact probability of a power grid failure in the next year.
   • BSelecting the specific brand of backup generator to purchase for the hospital.
   • CListing all hardware and software vendors used by the hospital.
   • DDetermining the maximum acceptable downtime for the admission system and prioritizing its recovery over less critical systems.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A hospital's business continuity plan includes a communication protocol for a pandemic scenario. The plan states that the incident commander will send daily email updates to all staff. During a pandemic, the hospital's email system is overwhelmed and becomes unreliable. The incident commander needs to communicate critical updates to staff quickly. What should the incident commander do?

   • AContinue sending emails and hope the system recovers.
   • BPost updates on the hospital's internal website only.
   • CWait until the email system is restored before communicating.
   • DUse a redundant communication channel such as SMS or a secure messaging app that is not dependent on the email system.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A healthcare provider's business continuity plan (BCP) includes a call tree for notifying key personnel during an incident. During a scheduled test, the incident commander calls the first person on the call tree, but that person does not answer. The call tree has no alternate contact instructions. What is the most appropriate action for the incident commander?

   • AFollow the call tree's escalation procedure, if one exists, or contact the next person on the list.
   • BAbort the test and reschedule it for a time when all personnel are available.
   • CContact the person's manager to find out where they are.
   • DLeave a voicemail and wait for a callback before continuing the call tree.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A financial institution's disaster recovery plan (DRP) has not been tested in three years. The plan includes a failover to a secondary data center. During a recent audit, the auditor found that the DRP's contact list is outdated and that the failover procedure references old server names. The institution's management wants to validate the plan without causing a disruption to production systems. Which testing approach is most appropriate?

   • AReview the plan's documentation without any exercise, because the plan is only for reference.
   • BConduct a parallel test by running the secondary data center alongside production.
   • CConduct a tabletop exercise to review the plan's procedures and identify gaps, then update the plan.
   • DPerform a full failover to the secondary data center to test the plan in a real-world scenario.
   Reveal Solution Discussion Select an answer first