CORES Incident Management & Business Continuity Planning 2 — Questions and Answers
Question 1: During a major IT outage, the incident commander's PRIMARY role is to:
- Personally resolve all technical issues
- Coordinate response activities and maintain situational awareness (Correct answer)
- Communicate exclusively with the media
- Approve all expenditures over $5,000
Correct answer: Coordinate response activities and maintain situational awareness
The incident commander coordinates the overall response effort and ensures all teams have current situational awareness rather than personally resolving technical issues.
Question 2: Which metric BEST measures the effectiveness of a Business Continuity Plan after activation?
- Number of employees notified
- Actual Recovery Time versus the target RTO (Correct answer)
- Cost of the incident response
- Number of media inquiries handled
Correct answer: Actual Recovery Time versus the target RTO
Comparing actual recovery time to the pre-defined Recovery Time Objective (RTO) directly measures whether the BCP achieved its operational goal.
Question 3: A 'warm site' in business continuity is characterized by:
- A fully operational duplicate facility with live data
- Pre-configured infrastructure that requires some setup before use (Correct answer)
- An empty building with power and connectivity only
- A mobile command vehicle kept on standby
Correct answer: Pre-configured infrastructure that requires some setup before use
A warm site has pre-installed hardware and connectivity but requires data restoration and some configuration before full operations can resume.
Question 4: The 'notification and escalation' phase of incident management primarily ensures that:
- The incident is resolved before leadership is informed
- Appropriate decision-makers are engaged at the right time (Correct answer)
- All customer complaints are logged
- Regulatory filings are completed within 24 hours
Correct answer: Appropriate decision-makers are engaged at the right time
Effective escalation protocols ensure that personnel with authority and resources needed to resolve the incident are engaged promptly.
Question 5: In BCP terminology, 'Maximum Tolerable Downtime' (MTD) represents:
- The average duration of past incidents
- The longest period a business process can be unavailable before causing unacceptable consequences (Correct answer)
- The time required to restore data from backups
- The regulatory deadline for incident reporting
Correct answer: The longest period a business process can be unavailable before causing unacceptable consequences
MTD defines the absolute outer boundary beyond which business survival, regulatory compliance, or critical obligations are jeopardized.
Question 6: When conducting a post-incident review, the 'five whys' technique is used to:
- Assign blame to responsible employees
- Identify the root cause by repeatedly asking why each failure occurred (Correct answer)
- Document the financial impact of the incident
- Evaluate the adequacy of insurance coverage
Correct answer: Identify the root cause by repeatedly asking why each failure occurred
The five whys iteratively drills into the chain of causation until the fundamental root cause is identified, enabling preventive action.
Question 7: Which statement BEST describes the relationship between Disaster Recovery (DR) and Business Continuity Planning (BCP)?
- DR and BCP are interchangeable terms for the same process
- DR focuses on restoring IT systems and is a subset of the broader BCP (Correct answer)
- BCP is only concerned with natural disaster events
- DR replaces BCP once IT systems are modernized
Correct answer: DR focuses on restoring IT systems and is a subset of the broader BCP
Disaster Recovery specifically addresses IT system and data restoration, while Business Continuity Planning encompasses the full range of critical business functions, of which IT recovery is one component.
CORES Incident Management & Business Continuity Planning 2
During a major IT outage, the incident commander's PRIMARY role is to: