CAP CAP Business Continuity & Disaster Recovery Planning 4 — Questions and Answers
Question 1: During a BCP exercise, an organization discovers that its Recovery Time Objective (RTO) for a critical system is 4 hours, but actual recovery takes 7 hours. What is the BEST corrective action?
- Accept the gap and update the BCP documentation
- Revise the RTO upward to match actual recovery time
- Implement additional resources or automation to close the RTO gap (Correct answer)
- Reclassify the system as non-critical to relax the RTO
Correct answer: Implement additional resources or automation to close the RTO gap
When actual recovery time exceeds the RTO, organizations should invest in resources, automation, or process improvements to close the gap and meet business requirements.
Question 2: Which BCP testing method provides the MOST realistic validation of recovery procedures without disrupting normal operations?
- Checklist review
- Tabletop exercise
- Parallel test (Correct answer)
- Full interruption test
Correct answer: Parallel test
A parallel test activates the alternate site and processes while the primary site continues operating, validating recovery capability without risking actual disruption.
Question 3: An organization's BIA identifies that a payroll system has an RPO of zero. What backup strategy BEST satisfies this requirement?
- Daily full backups
- Weekly incremental backups
- Synchronous real-time replication (Correct answer)
- Asynchronous replication with 15-minute lag
Correct answer: Synchronous real-time replication
An RPO of zero means no data loss is tolerable, which requires synchronous real-time replication so every transaction is committed to both sites simultaneously.
Question 4: Under NIST SP 800-34, which document establishes the scope, roles, responsibilities, and recovery strategies for an information system?
- Business Impact Analysis (BIA)
- Contingency Plan (CP) (Correct answer)
- Continuity of Operations Plan (COOP)
- Crisis Communications Plan
Correct answer: Contingency Plan (CP)
NIST SP 800-34 defines the Contingency Plan (CP) as the document covering system-level scope, roles, recovery strategies, and procedures for an information system.
Question 5: A cloud-based organization stores backups in the same geographic region as production. Which risk does this practice FAIL to mitigate?
- Hardware failure of individual servers
- Software bugs corrupting production data
- Regional disasters affecting both sites simultaneously (Correct answer)
- Accidental deletion of files by administrators
Correct answer: Regional disasters affecting both sites simultaneously
Storing backups in the same region means a regional disaster (hurricane, flood, power grid failure) could destroy both production and backup simultaneously.
Question 6: Which role is PRIMARILY responsible for declaring a disaster and activating the Disaster Recovery Plan (DRP)?
- IT Security Manager
- System Owner or designated executive authority (Correct answer)
- Backup Administrator
- CISO
Correct answer: System Owner or designated executive authority
The System Owner or a designated executive authority (often called the Disaster Recovery Coordinator or senior management) holds primary authority to declare a disaster and activate the DRP.
Question 7: An organization conducts a BIA and finds that its e-commerce platform generates $500,000 per hour. The Maximum Tolerable Downtime (MTD) is 2 hours. Which statement is CORRECT?
- The RTO must be less than or equal to 2 hours (Correct answer)
- The RPO must be less than or equal to 2 hours
- The RTO and RPO combined must not exceed $1,000,000
- The MTD is irrelevant if cyber insurance covers the loss
Correct answer: The RTO must be less than or equal to 2 hours
The RTO must be set at or below the MTD (2 hours) because exceeding the MTD causes unacceptable business impact; the RTO is derived from the MTD.
CAP CAP Business Continuity & Disaster Recovery Planning 4
During a BCP exercise, an organization discovers that its Recovery Time Objective (RTO) for a critical system is 4 hours, but actual recovery takes 7 hours.
What is the BEST corrective action?