What is the primary purpose of an after-action review (AAR)?

To assign blame for failures during the response

To document the disaster for insurance claims

To celebrate the success of the response team

To analyze the effectiveness of the response and identify improvements

Who should participate in an after-action review?

All key personnel involved in the disaster response

A company has been operating from its alternate site for two weeks after a fire. The primary site has been restored, and the recovery team is ready to transition operations back. The transition plan requires that the alternate site remain operational until the primary site has been stable for 72 hours. What is the primary reason for this requirement?

To ensure that the primary site is fully functional and stable before decommissioning the alternate site.

To allow time for the after-action review to be conducted.

To give employees time to adjust to returning to the primary site.

To allow the alternate site to be cleaned and prepared for future use.

Which element is typically included in a disaster communication plan?

A list of designated spokespersons and their contact information

A detailed inventory of all IT hardware

The technical steps to restore servers

The financial authorization limits for purchasing equipment

A company has just completed its disaster recovery response to a ransomware attack. The incident commander wants to collect lessons learned to improve future responses. Which method is most effective for gathering comprehensive feedback?

Hold a facilitated after-action review meeting with key stakeholders to discuss what happened, what went well, and what could be improved.

Wait for the next disaster to occur and observe the response.

Review only the incident logs and technical reports to identify failures.

Conduct a survey of all employees involved in the response, asking them to rate their own performance.

Information Systems Security Management Professional

Domain 5Objective 4

5.4 Manage Disaster Response and Recovery Process ISSMP Practice Questions (Page 4)

Part of the Contingency Management domain, which accounts for 12% of the ISSMP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–14 in this domain), expect 2–4 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

11concepts

12%of the exam

11 Concepts in This Objective

Disaster declaration criteria
Disaster declaration process
Disaster communication plan
Activation of the business continuity plan
Incident command and coordination
Resource management during response
Restoration of critical functions
Transition to normal operations
Lessons learned collection
After-action review
Plan update and improvement

Questions 16–20

16foundation · easy
What is the primary purpose of an after-action review (AAR)?
Select an answer first
17foundation · easy
Who should participate in an after-action review?
Select an answer first
18expert · hard
A company has been operating from its alternate site for two weeks after a fire. The primary site has been restored, and the recovery team is ready to transition operations back. The transition plan requires that the alternate site remain operational until the primary site has been stable for 72 hours. What is the primary reason for this requirement?
Select an answer first
19foundation · easy
Which element is typically included in a disaster communication plan?
Select an answer first
20application · medium
A company has just completed its disaster recovery response to a ransomware attack. The incident commander wants to collect lessons learned to improve future responses. Which method is most effective for gathering comprehensive feedback?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSMP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSMP” is a trademark of its owner, used for identification only.