CISM Business Continuity and Disaster Recovery 3

Question 1

When reviewing BC/DR plans, the information security manager should PRIMARILY ensure that:

Accepted Answer

Security controls are maintained and not bypassed during recovery operations

Answer

The information security manager must ensure that security controls remain in force during recovery, as the pressure to restore quickly can lead to shortcuts that introduce vulnerabilities.

Question 2

How often should a Business Continuity Plan be tested at MINIMUM according to best practices?

Accepted Answer

At least annually, and after any significant change to the environment

Answer

Best practices and most frameworks require BCP testing at least annually and after any significant changes to ensure the plan remains effective and current.

Question 3

Which element should be included in a crisis communications plan?

Accepted Answer

Pre-approved messaging templates and designated spokespersons for stakeholder communication

Answer

A crisis communications plan defines who communicates, what is communicated, and provides pre-approved templates to ensure timely, consistent, and accurate messaging during a disruption.

Question 4

A succession plan within business continuity primarily addresses:

Accepted Answer

Designating backup personnel who can assume critical roles if key individuals are unavailable

Answer

A succession plan ensures that backup personnel are identified and trained to assume critical roles if primary individuals are unavailable during a crisis.

Question 5

Which statement BEST describes the relationship between RTO and MTD?

Accepted Answer

RTO must always be shorter than MTD to ensure recovery occurs before irreversible harm

Answer

RTO must be set shorter than MTD to ensure systems are recovered before the maximum tolerable period of disruption is breached, avoiding irreversible business impact.

CISM - Certified Information Security Manager Practice Test

CISM - Certified Information Security Manager Practice Test

CISM Business Continuity and Disaster Recovery 3