Resilience and Continuity CRISC Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A hospital's IT department has a disaster recovery plan that has never been tested. The plan includes roles for the incident commander, communications lead, and technical recovery teams. Management wants to validate the plan's coordination and communication procedures without incurring downtime or affecting patient care. Which of the following testing methods is MOST appropriate?

   • ATabletop exercise with key stakeholders walking through the plan step by step
   • BParallel test of the backup systems in a sandbox environment
   • CSimulation test with a mock cyberattack scenario
   • DFull-scale failover test to the alternate data center
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A manufacturing company is conducting a business impact analysis (BIA) to prioritize its systems for disaster recovery. The BIA team has gathered the following data: the production scheduling system supports real-time order processing and has a maximum tolerable downtime of 2 hours; the HR payroll system can tolerate 48 hours of downtime; the email system can tolerate 24 hours. Which system should be assigned the HIGHEST recovery priority?

   • AProduction scheduling system
   • BEmail system
   • CAll systems should have equal priority
   • DHR payroll system
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary advantage of conducting a full-scale disaster recovery test?

   • AIt requires no preparation or planning
   • BIt is the least expensive testing method
   • CIt can be completed in a short time without impacting operations
   • DIt provides the highest level of assurance that the recovery plan will work in a real disaster
   Reveal Solution Discussion Select an answer first
5. 9expert · medium

   A company has a disaster recovery plan that relies on a hot site with synchronous replication. The RTO is 2 hours and RPO is 15 minutes. During a disaster declaration, the incident commander discovers that the hot site's activation requires the database administrator (DBA) to manually run a script to bring the database online. The DBA is on vacation and unreachable. What is the MOST significant risk to meeting the RTO?

   • AThe hot site will not have the latest data because replication is asynchronous.
   • BThe RPO will be exceeded because synchronous replication is not working.
   • CThe incident commander will be unable to communicate with the recovery team.
   • DThe RTO will be exceeded because the activation process depends on a single individual.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the primary purpose of data replication in a disaster recovery strategy?

   • ATo compress data to speed up network transmission
   • BTo create a backup of data that is stored in a different geographic location
   • CTo encrypt data to protect it from unauthorized access
   • DTo reduce the storage capacity required for data backups
   Reveal Solution Discussion Select an answer first