CCISO Business Continuity 3 — Questions and Answers
Question 1: What is the primary purpose of a Business Continuity Policy?
- To document all technical recovery procedures
- To establish management commitment and high-level framework for BC activities (Correct answer)
- To replace the Disaster Recovery Plan
- To define specific RTO and RPO values for each system
Correct answer: To establish management commitment and high-level framework for BC activities
A BC Policy communicates executive commitment, defines scope, assigns accountability, and provides the governance framework for all continuity activities.
Question 2: Which concept refers to the point beyond which a business function cannot recover and the organization would cease to operate viably?
- Recovery Point Objective (RPO)
- Recovery Time Objective (RTO)
- Maximum Tolerable Downtime (MTD) (Correct answer)
- Work Recovery Time (WRT)
Correct answer: Maximum Tolerable Downtime (MTD)
MTD (also called Maximum Tolerable Period of Disruption) is the maximum time a business function can be unavailable before the organization suffers irreversible harm.
Question 3: When prioritizing recovery efforts, a CISO should base decisions primarily on:
- System replacement cost
- The criticality and interdependencies identified in the BIA (Correct answer)
- The preferences of individual department heads
- The age of the technology involved
Correct answer: The criticality and interdependencies identified in the BIA
The BIA provides objective data on financial and operational impact, enabling the CISO to prioritize recovery of the most critical and interdependent systems first.
Question 4: A tabletop exercise differs from a simulation test in that a tabletop exercise:
- Requires full system failover to an alternate site
- Is a discussion-based review without actual execution of recovery procedures (Correct answer)
- Involves real data loss to test backup restoration
- Requires all employees to evacuate the building
Correct answer: Is a discussion-based review without actual execution of recovery procedures
Tabletop exercises are structured discussions where team members walk through a scenario to identify gaps without activating the actual plan or disrupting operations.
Question 5: Which of the following is a key reason organizations implement geographic diversity in their BC strategy?
- To reduce software licensing costs
- To avoid single points of failure due to regional disasters (Correct answer)
- To comply with data sovereignty laws exclusively
- To improve application performance for end users
Correct answer: To avoid single points of failure due to regional disasters
Geographic diversity ensures that a regional disaster (earthquake, hurricane, power grid failure) cannot simultaneously affect both the primary and recovery sites.
Question 6: In the context of supply chain resilience within BCP, which practice best mitigates single-supplier risk?
- Negotiating lower prices with the existing supplier
- Maintaining a list of qualified alternate suppliers for critical components (Correct answer)
- Increasing on-site inventory to six months' supply
- Transferring supplier risk entirely to cyber insurance
Correct answer: Maintaining a list of qualified alternate suppliers for critical components
Pre-qualifying alternate suppliers ensures the organization can quickly pivot to another source if the primary supplier is disrupted, reducing single-point-of-failure risk.
Question 7: Which role is typically responsible for declaring a disaster and formally activating the Business Continuity Plan?
- The IT Help Desk Manager
- The Crisis Management Team or designated executive authority (Correct answer)
- The Chief Information Security Officer exclusively
- Any employee who witnesses the incident
Correct answer: The Crisis Management Team or designated executive authority
Formal disaster declaration authority is granted to a Crisis Management Team or a designated senior executive to ensure consistent, authorized activation of the BCP.
CCISO Business Continuity 3
What is the primary purpose of a Business Continuity Policy?