5.1 Facilitate Development of Contingency Plans ISSMP Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A hospital's disaster recovery plan relies on a third-party vendor to restore its patient portal. The vendor's contract specifies a 6-hour RTO, but the hospital's BIA requires a 2-hour RTO. The vendor has never been tested for a full recovery. The hospital's IT director wants to conduct a full test, but the vendor charges a high fee and requires 30 days' notice. The hospital's compliance team is concerned about patient data privacy during the test. Which action best addresses the verification and compliance concerns?

   • ASwitch to a different vendor that can meet the 2-hour RTO and has been tested.
   • BSkip the full test and rely on the vendor's SLA to meet the RTO.
   • CNegotiate a lower fee for the test by reducing the scope to a tabletop exercise.
   • DConduct a full test with the vendor, ensuring that patient data is anonymized before the test.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the purpose of verification in the context of a Disaster Recovery Plan (DRP)?

   • ATo eliminate the need for backup systems
   • BTo reduce the cost of disaster recovery
   • CTo ensure the plan's recovery procedures are effective and achievable
   • DTo replace the need for a Business Impact Analysis
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A logistics company relies on a third-party cloud provider for its shipment tracking system. The provider's service level agreement (SLA) guarantees 99.9% availability, but the company's BIA requires the system to be available 99.99% of the time. The company is considering adding a second cloud provider to improve availability. Which factor is most important to evaluate before making this decision?

   • AThe geographic location of the second provider's data centers.
   • BThe ability to synchronize data between the two providers to ensure consistency.
   • CThe second provider's ability to meet the required RTO and RPO for the shipment tracking system.
   • DThe cost of the second provider compared to the potential revenue loss from downtime.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Why is it important to define roles and responsibilities in a contingency plan?

   • ATo keep the plan confidential
   • BTo reduce the number of employees needed
   • CTo eliminate the need for training
   • DTo ensure clear accountability during a disruption
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which of the following is typically included in an internal crisis communications plan?

   • AInstructions for employees on how to receive updates during an incident
   • BThe organization's product roadmap
   • CA list of customer credit card numbers
   • DThe organization's annual financial report
   Reveal Solution Discussion Select an answer first