CISM Business Continuity and Disaster Recovery 3

Question 1

When reviewing BC/DR plans, the information security manager should PRIMARILY ensure that:

Accepted Answer

Security controls are maintained and not bypassed during recovery operations

Answer

Recovery sites are located in geographically distant regions from the primary site

Answer

All employees receive training on disaster recovery procedures annually

Answer

Insurance coverage adequately compensates for losses during a business interruption

Question 2

How often should a Business Continuity Plan be tested at MINIMUM according to best practices?

Accepted Answer

At least annually, and after any significant change to the environment

Answer

Every five years or after a significant organizational change

Answer

Only when required by a regulatory audit or compliance assessment

Answer

Whenever new executive leadership joins the organization

Question 3

Which element should be included in a crisis communications plan?

Accepted Answer

Pre-approved messaging templates and designated spokespersons for stakeholder communication

Answer

Technical specifications for backup hardware at the recovery site

Answer

Database recovery scripts and step-by-step IT restoration procedures

Answer

Financial projections for losses during a declared business interruption

Question 4

A succession plan within business continuity primarily addresses:

Accepted Answer

Designating backup personnel who can assume critical roles if key individuals are unavailable

Answer

The order in which IT systems are restored after a disaster

Answer

Planning for the acquisition of a competitor following a market disruption

Answer

Scheduling the rotation of staff across different recovery teams

Question 5

Which statement BEST describes the relationship between RTO and MTD?

Accepted Answer

RTO must always be shorter than MTD to ensure recovery occurs before irreversible harm

Answer

RTO and MTD are interchangeable terms used by different frameworks

Answer

MTD is determined by IT and RTO is determined by business units independently

Answer

RTO defines the data loss threshold while MTD defines the downtime threshold

Question 6

When conducting a parallel test during disaster recovery, the organization is:

Accepted Answer

Running recovery systems simultaneously alongside production to validate functionality without disruption

Answer

Shutting down primary systems and routing all traffic to the recovery site

Answer

Discussing recovery procedures with stakeholders without activating any systems

Answer

Migrating all data to a cloud backup environment for a 24-hour period

Question 7

What is the MOST important reason for involving business unit leaders in Business Continuity Plan development?

Accepted Answer

To accurately identify critical processes, dependencies, and acceptable recovery targets

Answer

To ensure IT recovery time objectives align with budgetary constraints

Answer

To satisfy regulatory requirements that mandate cross-functional participation

Answer

To reduce the workload on the information security team during planning