CAP CAP Business Continuity & Disaster Recovery Planning 1 — Questions and Answers
Question 1: What is the primary purpose of a Contingency Plan (CP) for a federal information system as described in NIST SP 800-34?
- To define employee evacuation procedures during physical emergencies
- To provide instructions for recovering an information system after a disruption or disaster (Correct answer)
- To document backup power requirements for server rooms
- To establish vendor escalation procedures for hardware failures
Correct answer: To provide instructions for recovering an information system after a disruption or disaster
NIST SP 800-34 defines a Contingency Plan as procedures to restore IT operations and data following a disruption, ensuring mission-essential functions can continue or be quickly recovered.
Question 2: Recovery Time Objective (RTO) is best defined as which of the following?
- The maximum tolerable data loss measured in time
- The maximum amount of time allowed to restore a system to operational status after a disruption (Correct answer)
- The time required to complete a full backup
- The scheduled maintenance window for system updates
Correct answer: The maximum amount of time allowed to restore a system to operational status after a disruption
RTO defines the maximum acceptable duration of downtime — from the point of disruption to the point when the system must be restored to operational functionality.
Question 3: Recovery Point Objective (RPO) determines which aspect of disaster recovery planning?
- The geographic distance between primary and backup data centers
- The maximum acceptable amount of data loss measured in time (Correct answer)
- The number of backup copies required for compliance
- The priority order of system restoration
Correct answer: The maximum acceptable amount of data loss measured in time
RPO defines the maximum tolerable period of data loss, which directly drives backup frequency — if the RPO is 4 hours, backups must occur at least every 4 hours.
Question 4: Which type of disaster recovery site is fully equipped and operational, allowing immediate failover with minimal downtime?
- Cold site
- Warm site
- Hot site (Correct answer)
- Mobile site
Correct answer: Hot site
A hot site is a fully operational duplicate facility with live data replication, allowing organizations to failover with minimal or near-zero downtime.
Question 5: NIST SP 800-34 recommends that contingency plans be tested at what minimum frequency?
- Monthly
- Quarterly
- Annually (Correct answer)
- Every three years
Correct answer: Annually
NIST SP 800-34 recommends that contingency plans be tested and exercised at least annually to verify recovery procedures remain effective and personnel are trained.
Question 6: What is the relationship between Business Continuity Planning (BCP) and Disaster Recovery Planning (DRP)?
- BCP and DRP are identical documents with different names
- BCP focuses on sustaining business operations broadly while DRP specifically addresses IT system recovery (Correct answer)
- DRP covers all organizational functions while BCP is limited to IT systems
- BCP is required only for classified systems while DRP applies to all systems
Correct answer: BCP focuses on sustaining business operations broadly while DRP specifically addresses IT system recovery
BCP addresses the continuity of all critical business functions and processes, while DRP is a subset focused specifically on restoring IT infrastructure and data systems after a disruption.
CAP CAP Business Continuity & Disaster Recovery Planning 1
What is the primary purpose of a Contingency Plan (CP) for a federal information system as described in NIST SP 800-34?