Incident Response and Business Continuity GSLC Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary purpose of a post-incident review?

   • ATo assign blame to individuals for the incident
   • BTo identify lessons learned and improve future incident response
   • CTo delete all evidence related to the incident
   • DTo determine the financial cost of the incident
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   After containing a malware infection on several servers, the incident response team is ready to eradicate the root cause. Which action is MOST appropriate for the eradication phase?

   • AMonitor the affected systems for a week to ensure the malware does not return.
   • BRestore all systems from backups taken before the infection.
   • CReimage all affected servers and reconnect them to the network immediately.
   • DRemove the malware from all affected systems and apply patches to close the vulnerability that was exploited.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A business continuity manager is planning the first test of a newly developed continuity plan. The goal is to validate the plan's feasibility without disrupting normal operations. Which type of exercise is MOST appropriate for this initial validation?

   • AA checklist review where the plan is compared against industry standards without involving personnel.
   • BA parallel test where the alternate site runs in parallel with the primary site using live data.
   • CA tabletop exercise where key personnel discuss their roles and walk through the plan step by step.
   • DA full-scale simulation that includes activating the alternate site and failing over production systems.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following is a key component of a business continuity plan?

   • AEmergency contact information for key personnel
   • BA detailed history of past incidents
   • CA list of all employee passwords
   • DThe organization's marketing strategy
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company is developing a business continuity plan for its e-commerce platform. The business impact analysis (BIA) has identified that the platform has a maximum tolerable downtime (MTD) of 4 hours and a maximum tolerable data loss of 15 minutes. The company has a limited budget and must choose between two continuity strategies: Strategy 1 uses a hot standby site with real-time data replication, and Strategy 2 uses a warm standby site with hourly data backups. Which strategy is MOST appropriate?

   • AStrategy 1, because it can meet both the RTO and RPO requirements, despite the higher cost.
   • BNeither strategy, because the requirements are too strict to be met with the available budget.
   • CStrategy 2, because it is more cost-effective and can still meet the RTO and RPO requirements.
   • DA combination of both strategies, using Strategy 1 for the first 2 hours and Strategy 2 for the remaining 2 hours.
   Reveal Solution Discussion Select an answer first