A company's backup verification process involves restoring a random sample of files from each backup. The security team wants to increase confidence in recoverability without significantly increasing the time and cost of verification. Which approach would BEST achieve this?

Perform a full restore of the most critical systems and a sample restore of less critical systems

Verify the backup file integrity using checksums only

Increase the sample size of files restored from each backup

Restore all files from every backup

What is the primary purpose of collecting backup verification data?

To identify which employees have access to backup systems

To measure the speed of backup operations

To ensure that backups can be successfully restored when needed

To determine the cost of backup storage

What is the primary purpose of collecting evidence of management review and approval for security-related changes?

To reduce the need for security testing

To ensure that all changes are implemented automatically

To demonstrate that changes were authorized by appropriate personnel

To track the performance of individual employees

A company's DR plan has an RTO of 4 hours and an RPO of 1 hour. In the last DR test, the system was restored in 3.5 hours, but the data was from a backup that was 2 hours old. The DR team is considering whether to invest in more frequent backups. What data should they use to justify this investment?

The RPO was not met, indicating a risk of data loss that could be mitigated by more frequent backups

The test was successful because the system was restored, so no changes are needed

The RTO was met, so no investment is needed

The RTO was met, but the RPO was not, so the investment should be in faster recovery, not more frequent backups

Which of the following is an example of data collected from a DR test?

Actual time taken to restore systems from backups

Number of employees in the organization

Certified Information Systems Security Professional

Domain 6Objective 3

6.3 - Collect Security Process Data (e.g., Technical and Administrative) CISSP Practice Questions (Page 6)

Part of the Security Assessment and Testing domain, which accounts for 12% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–14 in this domain), expect 2–3 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

8concepts

12%of the exam

8 Concepts in This Objective

Account Management Data Collection
Management Review and Approval Processes
Key Performance Indicators (KPIs) for Security
Key Risk Indicators (KRIs) for Security
Backup Verification Data
Security Training and Awareness Metrics
Disaster Recovery (DR) Test Data
Business Continuity (BC) Exercise Data

Questions 26–30

26expert · medium
A company's backup verification process involves restoring a random sample of files from each backup. The security team wants to increase confidence in recoverability without significantly increasing the time and cost of verification. Which approach would BEST achieve this?
Select an answer first
27foundation · easy
What is the primary purpose of collecting backup verification data?
Select an answer first
28foundation · easy
What is the primary purpose of collecting evidence of management review and approval for security-related changes?
Select an answer first
29expert · medium
A company's DR plan has an RTO of 4 hours and an RPO of 1 hour. In the last DR test, the system was restored in 3.5 hours, but the data was from a backup that was 2 hours old. The DR team is considering whether to invest in more frequent backups. What data should they use to justify this investment?
Select an answer first
30foundation · easy
Which of the following is an example of data collected from a DR test?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.