An insurance company's BIA determines that its claims-processing system has an MTD of 12 hours. The IT team proposes a recovery solution that can restore the system in 10 hours, with data loss limited to the last 2 hours. The business unit, however, insists that no more than 1 hour of data loss is acceptable. What is the most appropriate RPO for the claims-processing system?

2 hours, because the proposed IT solution can only achieve this level of data loss

12 hours, because this is the MTD for the system

10 hours, because this is the recovery time of the proposed solution

1 hour, because the business unit has defined this as the maximum acceptable data loss

Which of the following is the correct sequence of steps in conducting a Business Impact Analysis (BIA)?

Analysis, data collection, reporting

Data collection, analysis, reporting

Data collection, reporting, analysis

Reporting, data collection, analysis

Which of the following is an example of an external dependency for a business function?

A cloud service provider hosting critical applications.

The organization's internal IT help desk.

A utility company is initiating a BIA. The project sponsor wants to ensure the BIA focuses on the functions that are essential to the organization's survival and regulatory obligations. Which scope definition would best achieve this objective?

Include only the functions that are required by regulatory mandates

Include all functions that are directly related to information technology systems

Include only the functions that have experienced disruptions in the past year

Include all business functions that, if disrupted, would cause significant financial loss, regulatory non-compliance, or inability to deliver core services

Why is it important to identify external dependencies during a BIA?

To comply with regulatory requirements for third-party risk management.

To determine the financial value of external contracts.

To understand the impact of a disruption to an external entity on the organization's own processes.

To ensure that all external entities are included in the organization's insurance policies.

Certified Information Systems Security Professional

Domain 1Objective 7

1.7 - Identify, Analyze, Assess, Prioritize, and Implement Business Continuity (BC) Requirements CISSP Practice Questions (Page 5)

Part of the Security and Risk Management domain, which accounts for 16% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–19 in this domain), expect 1–2 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

8concepts

16%of the exam

Questions 21–25

21application · medium
An insurance company's BIA determines that its claims-processing system has an MTD of 12 hours. The IT team proposes a recovery solution that can restore the system in 10 hours, with data loss limited to the last 2 hours. The business unit, however, insists that no more than 1 hour of data loss is acceptable. What is the most appropriate RPO for the claims-processing system?
Select an answer first
22foundation · easy
Which of the following is the correct sequence of steps in conducting a Business Impact Analysis (BIA)?
Select an answer first
23foundation · easy
Which of the following is an example of an external dependency for a business function?
Select an answer first
24application · medium
A utility company is initiating a BIA. The project sponsor wants to ensure the BIA focuses on the functions that are essential to the organization's survival and regulatory obligations. Which scope definition would best achieve this objective?
Select an answer first
25foundation · easy
Why is it important to identify external dependencies during a BIA?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.