1.7 - Identify, Analyze, Assess, Prioritize, and Implement Business Continuity (BC) Requirements CISSP Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A financial services firm relies on a cloud-based SaaS provider for its customer relationship management (CRM) system. The BIA identifies this as a critical dependency with an RTO of 4 hours. The provider's standard SLA guarantees 99.9% uptime but does not specify restoration time after an outage. The firm's BC plan must ensure the CRM is recoverable within the RTO. What is the most effective strategy to incorporate this external dependency into the BC plan?

   • ANegotiate a custom SLA with the provider that includes a defined restoration time objective and regular testing of the recovery process
   • BAccept the provider's standard SLA because 99.9% uptime is sufficient for the firm's needs
   • CSwitch to a different SaaS provider that offers a higher uptime SLA
   • DMaintain an on-premises backup of the CRM data and restore it to a local server during an outage
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A retail company's BIA identifies three critical functions: online order processing (RTO of 2 hours), in-store point-of-sale (POS) transactions (RTO of 8 hours), and inventory management (RTO of 24 hours). The company has a limited budget and can only fully fund recovery strategies for one function in the current fiscal year. Which function should receive the highest priority for funding?

   • AOnline order processing, because it has the shortest RTO and generates the highest revenue per hour
   • BInventory management, because it supports both online and in-store operations
   • CIn-store POS transactions, because they serve customers physically present in the store
   • DAll three functions equally, because each is critical to the business
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   In the context of impact assessment, what does the Recovery Point Objective (RPO) define?

   • AThe minimum level of service required during a disruption.
   • BThe maximum amount of data loss that is acceptable for a business process.
   • CThe maximum time allowed to restore a business process after a disruption.
   • DThe total cost of downtime for a business process.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A global manufacturer's BIA identifies a single specialized component supplier as critical. This supplier is the only source for a part used in the company's flagship product. The supplier is located in a region prone to earthquakes. The company's risk appetite allows a maximum of 3 days of production downtime. The supplier's lead time for the component is 2 weeks, and the company maintains a 5-day inventory buffer. What is the most significant risk to the company's continuity?

   • AThe company's reliance on a single supplier creates a contractual risk if the supplier fails to deliver
   • BThe 5-day inventory buffer is insufficient to cover the 2-week lead time if the supplier is disrupted, exceeding the 3-day tolerance
   • CThe supplier's geographic location exposes the company to earthquake risk, which is unpredictable
   • DThe 2-week lead time is too long for the company to respond to any disruption
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A hospital is conducting a BIA for its patient-record system. The BIA team has collected data from department heads, including the maximum downtime each department can tolerate and the financial and operational impacts of a disruption. The team is now analyzing the data to identify the criticality of each department's reliance on the system. What is the next step in the BIA process after data collection and analysis?

   • AImmediately implement recovery strategies for the most critical departments
   • BConduct a new data collection round to verify the accuracy of the initial responses
   • CDevelop a detailed disaster recovery plan for the patient-record system
   • DReport the findings to senior management with prioritized recovery requirements and recommended continuity strategies
   Reveal Solution Discussion Select an answer first