CCISO Business Continuity 2 — Questions and Answers
Question 1: Which metric defines the maximum amount of data loss an organization can tolerate, expressed in time?
- Recovery Time Objective (RTO)
- Recovery Point Objective (RPO) (Correct answer)
- Maximum Tolerable Downtime (MTD)
- Service Delivery Objective (SDO)
Correct answer: Recovery Point Objective (RPO)
RPO defines the maximum acceptable age of files that must be recovered from backup storage to resume normal operations after a disaster.
Question 2: A CISO is reviewing a vendor's BCP. Which clause should be contractually required to ensure the vendor's recovery capabilities align with the organization's needs?
- Force majeure clause
- Service Level Agreement (SLA) with defined RTOs (Correct answer)
- Non-disclosure agreement (NDA)
- Limitation of liability clause
Correct answer: Service Level Agreement (SLA) with defined RTOs
SLAs with defined RTOs contractually bind vendors to meet the organization's recovery time requirements and provide recourse if they fail.
Question 3: During BCP development, which analysis identifies the minimum resources required to resume critical business functions?
- Threat and Risk Assessment (TRA)
- Business Impact Analysis (BIA) (Correct answer)
- Gap Analysis
- Vulnerability Assessment
Correct answer: Business Impact Analysis (BIA)
A BIA identifies critical business functions, their dependencies, and the minimum resources necessary to resume operations within acceptable timeframes.
Question 4: An organization uses a hot site for disaster recovery. What distinguishes a hot site from a warm site?
- A hot site is geographically closer to the primary site
- A hot site has fully operational systems with real-time data replication (Correct answer)
- A hot site only stores backup media
- A hot site requires 24–72 hours to become operational
Correct answer: A hot site has fully operational systems with real-time data replication
A hot site is a fully equipped and operational duplicate facility with real-time or near-real-time data replication, enabling near-immediate failover.
Question 5: Which BCP component ensures employees know their roles and responsibilities during a disruption?
- Crisis Communication Plan
- Business Impact Analysis
- Occupant Emergency Plan (OEP)
- Awareness and Training Program (Correct answer)
Correct answer: Awareness and Training Program
Awareness and training programs ensure all personnel understand their BCP roles, enabling coordinated and effective response during an actual disruption.
Question 6: A full-interruption BCP test is most valuable because it:
- Poses no operational risk to the organization
- Uses only tabletop scenarios without real system involvement
- Validates the plan under real-world conditions with actual failover (Correct answer)
- Reviews the plan documentation without any execution
Correct answer: Validates the plan under real-world conditions with actual failover
A full-interruption test activates the BCP completely, including actual failover to the alternate site, providing the most realistic validation of the plan.
Question 7: Which of the following best describes the purpose of a call tree in a BCP?
- To document network topology during a disaster
- To establish a structured notification chain to alert key personnel (Correct answer)
- To track financial losses during an incident
- To inventory critical assets at the recovery site
Correct answer: To establish a structured notification chain to alert key personnel
A call tree is a structured, hierarchical communication tool that ensures the right people are notified quickly and systematically during an incident.
CCISO Business Continuity 2
Which metric defines the maximum amount of data loss an organization can tolerate, expressed in time?