CIM Disaster Recovery & Business Continuity 3 — Questions and Answers
Question 1: A DR test reveals the restored database is missing three hours of transactions. Which control would most directly have prevented this gap?
- Increasing the frequency of full backups
- Implementing continuous log shipping or synchronous replication to reduce the RPO (Correct answer)
- Hiring additional database administrators
- Extending the RTO window in the DR plan
Correct answer: Implementing continuous log shipping or synchronous replication to reduce the RPO
Continuous log shipping or synchronous replication keeps the secondary database nearly current, shrinking the recovery point to seconds rather than hours.
Question 2: Under the NIST SP 800-34 framework, which phase immediately follows the BCP development phase?
- Plan testing, training, and exercises (Correct answer)
- Business Impact Analysis
- Contingency planning policy statement
- Plan maintenance
Correct answer: Plan testing, training, and exercises
NIST SP 800-34 sequences BCP phases as: policy → BIA → preventive controls → recovery strategies → plan development → testing/training/exercises → maintenance.
Question 3: What distinguishes a 'parallel test' from a 'full interruption test' in DR testing?
- Parallel tests involve only management; full interruption tests involve technical staff
- In a parallel test both primary and recovery systems run simultaneously; a full interruption test shuts down the primary (Correct answer)
- Parallel tests are conducted remotely; full interruption tests require on-site presence
- Parallel tests validate backups only; full interruption tests validate network configurations
Correct answer: In a parallel test both primary and recovery systems run simultaneously; a full interruption test shuts down the primary
A parallel test activates the DR site alongside the live primary with no risk of outage, while a full interruption test actually takes the primary offline to prove the DR site can carry production alone.
Question 4: Which of the following best describes a 'reciprocal agreement' as a business continuity strategy?
- A vendor contract guaranteeing hardware replacement within four hours
- Two organizations agree to host each other's operations in the event of a disaster (Correct answer)
- A government mandate requiring critical infrastructure operators to share recovery resources
- An SLA between a company and its cloud provider for uptime guarantees
Correct answer: Two organizations agree to host each other's operations in the event of a disaster
A reciprocal agreement is an informal or formal arrangement between organizations to provide mutual recovery space and resources, reducing individual DR costs.
Question 5: An incident manager is evaluating supply chain risks for the BCP. Which factor is MOST critical to assess for single-source suppliers?
- The supplier's marketing budget
- The supplier's geographic concentration and its vulnerability to the same disaster scenarios as the organization (Correct answer)
- The number of employees the supplier has
- Whether the supplier uses the same ERP system as the organization
Correct answer: The supplier's geographic concentration and its vulnerability to the same disaster scenarios as the organization
If a single-source supplier is in the same disaster zone, a regional event could eliminate both the organization and its sole supplier simultaneously.
Question 6: In a crisis communications plan, what is the primary role of a designated spokesperson?
- To make all technical recovery decisions during an incident
- To serve as the single, authoritative voice to external stakeholders, media, and the public (Correct answer)
- To coordinate logistics for alternate site activation
- To document lessons learned immediately after the incident
Correct answer: To serve as the single, authoritative voice to external stakeholders, media, and the public
A single spokesperson prevents conflicting messages, controls information flow, and maintains organizational credibility with external audiences during a crisis.
Question 7: Which metric measures the average time required to restore a failed system or component to full operation?
- Mean Time Between Failures (MTBF)
- Recovery Time Objective (RTO)
- Mean Time to Repair (MTTR) (Correct answer)
- Recovery Point Objective (RPO)
Correct answer: Mean Time to Repair (MTTR)
MTTR is the historical average time to repair or restore a system, used to set realistic RTOs and assess team and vendor performance.
CIM Disaster Recovery & Business Continuity 3
A DR test reveals the restored database is missing three hours of transactions.
Which control would most directly have prevented this gap?