Disaster Recovery & Business Continuity Flashcards

A financial services firm experiences a ransomware attack that encrypts all production data. Which DR capability is most critical for rapid recovery without paying the ransom?

Answer: Immutable, air-gapped backups that cannot be encrypted by ransomware

Immutable and air-gapped backups are isolated from the production network and cannot be altered or encrypted by ransomware, making them the most reliable recovery option.

What is the key difference between disaster recovery (DR) and business continuity (BC)?

Answer: DR is a subset of BC; DR focuses on restoring IT systems while BC encompasses keeping all business operations running

Business continuity is the broader discipline of maintaining essential functions during a disruption; disaster recovery specifically addresses restoring IT infrastructure and data.

During a major outage, the incident manager learns that the alternate processing site lacks sufficient bandwidth for production workloads. Which BCP phase should have identified this gap?

Answer: Testing and exercises

Regular testing and exercises—particularly simulation or full interruption tests—are designed to uncover infrastructure shortfalls like inadequate bandwidth before a real disaster.

Which concept refers to the geographic distribution of data centers to ensure a regional disaster does not affect all copies of critical data?

Answer: Geographic redundancy

Geographic redundancy places copies of data and infrastructure in separate locations far enough apart to avoid common regional failure modes such as hurricanes or earthquakes.

A BCP calls for staff to work remotely during a facility outage, but employees lack company-issued laptops. What planning assumption failed?

Answer: The personnel resource assumption regarding equipment availability

BCPs must account for the actual equipment available to staff; assuming remote work capability without ensuring devices are issued is a personnel resource planning gap.

In ISO 22301 (Business Continuity Management Systems), what is the purpose of the 'interested parties' analysis?

Answer: To determine which stakeholders have requirements and expectations that the BCMS must address

ISO 22301 requires organizations to identify interested parties (customers, regulators, partners, communities) and understand their continuity-related needs and expectations.

Which recovery strategy involves contracting with a third-party provider to deliver pre-configured systems to any location within a specified timeframe?

Answer: Mobile/portable recovery

Mobile or portable recovery solutions deliver pre-staged equipment (servers, communications gear) to any designated location, offering flexibility when a fixed alternate site is impractical.