A financial services firm's primary site is hit by a cyberattack that encrypts critical systems, and the disaster has been declared. The business continuity plan (BCP) includes a detailed activation procedure. The incident commander has just received the declaration. What is the first step the incident commander should take to activate the BCP?

Immediately deploy all recovery teams to the alternate site without any prior coordination.

Wait for the IT team to confirm that the primary site cannot be restored before activating the BCP.

Contact the organization's legal counsel to review the BCP for any potential liabilities before activation.

Notify the crisis management team and convene an emergency meeting to review the situation and authorize activation.

What is the purpose of restoring IT systems in a prioritized order?

To reduce the total cost of the recovery

To ensure that systems supporting critical business functions are available first

To simplify the restoration process

To satisfy regulatory requirements

During a major regional power outage, a utility company activates its incident command system (ICS). The incident commander has established a unified command with local emergency services. The company's IT disaster recovery team is working to restore critical SCADA systems. What is the primary responsibility of the incident commander in this scenario?

Ensure that the SCADA systems are restored before any other business functions.

Coordinate the overall response, allocate resources, and set priorities for the recovery effort.

Directly manage the technical restoration of the SCADA systems.

Communicate directly with all employees and customers about the outage status.

What is the main objective of the transition to normal operations phase?

To close the incident and stop all recovery activities

To return all business functions to the primary site and normal processes

To decommission the alternate site permanently

To conduct a full audit of the disaster

Following a major cyber incident, the incident response team conducts an after-action review (AAR). The AAR reveals that the team lacked clear roles and responsibilities, leading to confusion during the response. What should the team do with this finding?

Document the finding in the AAR report and move on to the next topic.

Blame the incident commander for the lack of clarity and replace them.

Conduct another AAR to confirm the finding before making any changes.

Immediately update the incident response plan to clearly define roles and responsibilities.

Information Systems Security Management Professional

Domain 5Objective 4

5.4 Manage Disaster Response and Recovery Process ISSMP Practice Questions (Page 7)

Part of the Contingency Management domain, which accounts for 12% of the ISSMP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–14 in this domain), expect 2–4 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

11concepts

12%of the exam

11 Concepts in This Objective

Disaster declaration criteria
Disaster declaration process
Disaster communication plan
Activation of the business continuity plan
Incident command and coordination
Resource management during response
Restoration of critical functions
Transition to normal operations
Lessons learned collection
After-action review
Plan update and improvement

Questions 31–35

31application · medium
A financial services firm's primary site is hit by a cyberattack that encrypts critical systems, and the disaster has been declared. The business continuity plan (BCP) includes a detailed activation procedure. The incident commander has just received the declaration. What is the first step the incident commander should take to activate the BCP?
Select an answer first
32foundation · easy
What is the purpose of restoring IT systems in a prioritized order?
Select an answer first
33application · medium
During a major regional power outage, a utility company activates its incident command system (ICS). The incident commander has established a unified command with local emergency services. The company's IT disaster recovery team is working to restore critical SCADA systems. What is the primary responsibility of the incident commander in this scenario?
Select an answer first
34foundation · easy
What is the main objective of the transition to normal operations phase?
Select an answer first
35application · medium
Following a major cyber incident, the incident response team conducts an after-action review (AAR). The AAR reveals that the team lacked clear roles and responsibilities, leading to confusion during the response. What should the team do with this finding?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSMP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSMP” is a trademark of its owner, used for identification only.

5.4 Manage Disaster Response and Recovery Process ISSMP Practice Questions (Page 7)

Questions 31–35

What is the purpose of restoring IT systems in a prioritized order?

What is the main objective of the transition to normal operations phase?

Following a major cyber incident, the incident response team conducts an after-action review (AAR). The AAR reveals that the team lacked clear roles and responsibilities, leading to confusion during the response. What should the team do with this finding?

Keep studying — Contingency Management