CGRC Incident Response and Contingency Planning

Question 1

According to NIST SP 800-61, which of the following is the CORRECT sequence of phases in an incident response lifecycle?

Accepted Answer

Preparation → Detection and Analysis → Containment, Eradication, and Recovery → Post-Incident Activity

Answer

NIST SP 800-61 defines four incident response phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity (which includes the lessons-learned process). The other sequences mix elements of different frameworks or incorrectly order the phases.

Question 2

What is the key distinction between a Contingency Plan and a Disaster Recovery Plan (DRP)?

Accepted Answer

A Contingency Plan covers all types of disruptions to information systems, while a DRP focuses specifically on recovering IT systems after a major disaster

Answer

Per NIST SP 800-34, a Contingency Plan is a broader document covering a range of disruptive events affecting information systems. A Disaster Recovery Plan is a subset that specifically addresses recovery of IT infrastructure following a major disaster. The Contingency Plan may reference or incorporate the DRP.

Question 3

An organization's management states that their critical payroll system must be restored to full operation within 4 hours of a disruption. This requirement is BEST described as which of the following?

Accepted Answer

Recovery Time Objective (RTO)

Answer

The Recovery Time Objective (RTO) defines the maximum acceptable length of time that a system can be offline after a disruption. The RPO defines how much data loss is acceptable (measured in time). MTD is the absolute maximum time a business function can be unavailable before mission failure. MTTR is a reliability metric for average repair time.

Question 4

During a contingency plan test, an organization uses actual production data and physically shuts down the primary data center, requiring IT staff to activate the alternate site. This type of test is BEST described as which of the following?

Accepted Answer

Full interruption test

Answer

A full interruption test (also called a full-scale test) involves actually shutting down the primary system and activating the backup/alternate site, making it the most realistic but also most disruptive and risky test type. A parallel test runs both sites simultaneously. A tabletop exercise is discussion-based. A structured walk-through reviews the plan without operational activation.

Question 5

Which NIST Special Publication provides the primary guidance for developing and testing contingency plans for federal information systems?

Accepted Answer

NIST SP 800-34

Answer

NIST SP 800-34, 'Contingency Planning Guide for Federal Information Systems,' is the primary reference for developing, testing, and maintaining contingency plans. SP 800-53 contains the security control catalog (including CP controls), SP 800-61 covers incident response, and SP 800-137 covers continuous monitoring.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC Incident Response and Contingency Planning