CCISO Business Continuity 5 — Questions and Answers
Question 1: During a BC plan review, a CISO discovers that critical contact information for key vendors is outdated. This represents a failure in which BCP maintenance activity?
- Business Impact Analysis
- Plan testing and exercises
- Plan maintenance and update procedures (Correct answer)
- Crisis communication training
Correct answer: Plan maintenance and update procedures
Keeping contact lists, vendor information, and plan details current is a fundamental BCP maintenance responsibility that must be performed on a regular schedule.
Question 2: What is the primary objective of crisis communications within a Business Continuity framework?
- To limit legal liability by controlling all external statements
- To ensure timely, accurate information reaches all stakeholders during a disruption (Correct answer)
- To replace the incident response communication plan
- To notify law enforcement of all business disruptions
Correct answer: To ensure timely, accurate information reaches all stakeholders during a disruption
Effective crisis communications ensure employees, customers, regulators, and partners receive consistent and accurate information to maintain trust and coordinate response.
Question 3: A CISO is designing a BC strategy for a cloud-based SaaS application. Which recovery approach best aligns with a very low RTO requirement?
- Daily backup to a cold standby environment
- Multi-region active-active deployment with automated failover (Correct answer)
- Weekly full backups stored in a third-party vault
- Manual failover to a warm site within 24 hours
Correct answer: Multi-region active-active deployment with automated failover
Multi-region active-active deployments with automated failover achieve the lowest possible RTO by eliminating manual intervention and maintaining live redundant capacity.
Question 4: Which of the following is an example of a preventive BC control rather than a recovery BC control?
- Failover to a hot site after a primary data center fire
- Restoring data from off-site backup tapes
- Installing uninterruptible power supplies (UPS) to prevent power outages (Correct answer)
- Activating the crisis communication plan
Correct answer: Installing uninterruptible power supplies (UPS) to prevent power outages
A UPS is a preventive control that avoids downtime by maintaining power during outages, preventing a disruption from occurring in the first place.
Question 5: An organization's BCP requires restoring operations within 4 hours but the BIA identified an MTD of 6 hours. Which statement is correct?
- The RTO exceeds the MTD, creating an unacceptable risk gap
- The RTO is within the MTD, providing an acceptable recovery buffer (Correct answer)
- The RTO and MTD values are irrelevant to each other
- The MTD must always equal the RTO to be compliant
Correct answer: The RTO is within the MTD, providing an acceptable recovery buffer
When the RTO (4 hours) is less than the MTD (6 hours), the organization can restore operations before irreversible harm occurs, which is the desired BC posture.
Question 6: Which BC element addresses how the organization will manage communications with media and the public during a major disruption?
- Occupant Emergency Plan
- Public Relations and Media Communications Plan (Correct answer)
- IT Disaster Recovery Runbook
- Facilities Recovery Plan
Correct answer: Public Relations and Media Communications Plan
A Public Relations and Media Communications Plan provides pre-approved messaging, spokesperson assignments, and protocols for managing external communications during a crisis.
Question 7: After restoring operations at an alternate site following a disaster, what is the final phase of the BC process?
- Conducting a post-incident review and returning to normal operations (Correct answer)
- Deleting all data at the alternate site to prevent breach
- Immediately re-running the BIA to identify new risks
- Canceling the crisis management team activation
Correct answer: Conducting a post-incident review and returning to normal operations
The final BCP phase involves a structured return to normal operations at the primary site, followed by a post-incident review (lessons learned) to improve the plan.
CCISO Business Continuity 5
During a BC plan review, a CISO discovers that critical contact information for key vendors is outdated.
This represents a failure in which BCP maintenance activity?