CIM Disaster Recovery & Business Continuity 4 — Questions and Answers
Question 1: A financial services firm experiences a ransomware attack that encrypts all production data. Which DR capability is most critical for rapid recovery without paying the ransom?
- A comprehensive cyber insurance policy
- Immutable, air-gapped backups that cannot be encrypted by ransomware (Correct answer)
- A detailed forensic investigation report
- A public relations firm on retainer
Correct answer: Immutable, air-gapped backups that cannot be encrypted by ransomware
Immutable and air-gapped backups are isolated from the production network and cannot be altered or encrypted by ransomware, making them the most reliable recovery option.
Question 2: What is the key difference between disaster recovery (DR) and business continuity (BC)?
- DR is a subset of BC; DR focuses on restoring IT systems while BC encompasses keeping all business operations running (Correct answer)
- BC is a subset of DR; BC focuses only on communication while DR covers all operations
- DR and BC are interchangeable terms for the same set of activities
- DR applies only to natural disasters while BC applies only to cyber incidents
Correct answer: DR is a subset of BC; DR focuses on restoring IT systems while BC encompasses keeping all business operations running
Business continuity is the broader discipline of maintaining essential functions during a disruption; disaster recovery specifically addresses restoring IT infrastructure and data.
Question 3: During a major outage, the incident manager learns that the alternate processing site lacks sufficient bandwidth for production workloads. Which BCP phase should have identified this gap?
- Plan maintenance
- Crisis communications
- Testing and exercises (Correct answer)
- Incident closure
Correct answer: Testing and exercises
Regular testing and exercises—particularly simulation or full interruption tests—are designed to uncover infrastructure shortfalls like inadequate bandwidth before a real disaster.
Question 4: Which concept refers to the geographic distribution of data centers to ensure a regional disaster does not affect all copies of critical data?
- Data deduplication
- Geographic redundancy (Correct answer)
- RAID striping
- Data masking
Correct answer: Geographic redundancy
Geographic redundancy places copies of data and infrastructure in separate locations far enough apart to avoid common regional failure modes such as hurricanes or earthquakes.
Question 5: A BCP calls for staff to work remotely during a facility outage, but employees lack company-issued laptops. What planning assumption failed?
- The communication plan assumption
- The personnel resource assumption regarding equipment availability (Correct answer)
- The vendor SLA assumption
- The insurance coverage assumption
Correct answer: The personnel resource assumption regarding equipment availability
BCPs must account for the actual equipment available to staff; assuming remote work capability without ensuring devices are issued is a personnel resource planning gap.
Question 6: In ISO 22301 (Business Continuity Management Systems), what is the purpose of the 'interested parties' analysis?
- To identify shareholders who must approve the BCP budget
- To determine which stakeholders have requirements and expectations that the BCMS must address (Correct answer)
- To list all vendors contracted for disaster recovery services
- To identify employees responsible for executing recovery procedures
Correct answer: To determine which stakeholders have requirements and expectations that the BCMS must address
ISO 22301 requires organizations to identify interested parties (customers, regulators, partners, communities) and understand their continuity-related needs and expectations.
Question 7: Which recovery strategy involves contracting with a third-party provider to deliver pre-configured systems to any location within a specified timeframe?
- Hot site
- Warm site
- Mobile/portable recovery (Correct answer)
- Reciprocal agreement
Correct answer: Mobile/portable recovery
Mobile or portable recovery solutions deliver pre-staged equipment (servers, communications gear) to any designated location, offering flexibility when a fixed alternate site is impractical.
CIM Disaster Recovery & Business Continuity 4
A financial services firm experiences a ransomware attack that encrypts all production data.
Which DR capability is most critical for rapid recovery without paying the ransom?