5.1 Facilitate Development of Contingency Plans ISSMP Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   How can a contingency plan impact an organization's processes?

   • AIt eliminates the need for all existing processes
   • BIt may require changes to how critical processes are performed
   • CIt only affects IT processes
   • DIt has no effect on organizational processes
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A large hospital is developing a contingency plan for a cyberattack that could disrupt its electronic health record (EHR) system. The plan must assign roles for IT recovery, clinical operations, and patient communication. The hospital has a policy that only physicians can communicate with patients about their care. The IT team wants to send a mass notification to patients about the outage, but the policy requires physician approval. Which action best balances the need for timely patient communication with the hospital's policy?

   • APre-draft patient notification messages and have them approved by the chief medical officer in advance.
   • BDelay patient notification until the EHR system is restored.
   • CChange the hospital policy to allow IT to communicate with patients during emergencies.
   • DAllow the IT team to send the notification without physician approval to ensure timeliness.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the purpose of a succession plan in security management?

   • ATo replace all employees with contractors
   • BTo reduce the number of security staff
   • CTo eliminate the need for training
   • DTo ensure leadership continuity during disruptions
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A hospital's disaster recovery plan relies on a third-party vendor to restore the electronic health record (EHR) system. The vendor's contract specifies a 12-hour RTO, but the hospital's BIA requires EHR availability within 4 hours. The hospital's IT director wants to test the vendor's recovery capability, but the vendor charges a high fee for a full test. Which action best addresses the verification need without exceeding the budget?

   • AAccept the vendor's 12-hour RTO and update the BIA to reflect the longer downtime.
   • BSwitch to a different vendor that can meet the 4-hour RTO, even if the cost is higher.
   • CConduct a tabletop exercise with the vendor to walk through the recovery steps and identify gaps.
   • DPerform a partial technical test of the vendor's recovery process, focusing on the most critical components.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is an example of a contingency role that should be defined in a plan?

   • AChief Marketing Officer
   • BIncident Commander
   • CDatabase Administrator
   • DReceptionist
   Reveal Solution Discussion Select an answer first