CRP Recovery Strategy & Planning 3 ā Questions and Answers
Question 1: A company's IT recovery strategy specifies replication to a cloud provider. Which risk must be explicitly addressed in the plan?
- The cloud provider's office location
- Internet connectivity dependency and bandwidth during recovery (Correct answer)
- Number of cloud provider employees
- Cloud provider's stock market valuation
Correct answer: Internet connectivity dependency and bandwidth during recovery
Cloud-based recovery depends on network connectivity; if the disaster also disrupts internet service, the cloud recovery strategy may be inaccessible.
Question 2: The term 'Maximum Tolerable Downtime' (MTD) represents:
- The minimum time needed to restore a system
- The longest period a business function can be unavailable before causing irreparable harm (Correct answer)
- The average downtime experienced historically
- The time required to notify regulators of an outage
Correct answer: The longest period a business function can be unavailable before causing irreparable harm
MTD (also called Maximum Allowable Downtime) defines the absolute outer limit of acceptable unavailability before the business suffers unacceptable consequences.
Question 3: When should recovery strategies be re-evaluated after initial development?
- Only after an actual disaster occurs
- Only when requested by senior management
- Whenever significant changes occur to business operations, technology, or the threat environment (Correct answer)
- Every 10 years as part of long-term planning cycles
Correct answer: Whenever significant changes occur to business operations, technology, or the threat environment
Recovery strategies must be reviewed whenever material changes occur to processes, systems, staffing, or threats to ensure they remain effective.
Question 4: A 'cold site' recovery option is characterized by:
- Fully operational duplicate systems on standby
- Basic infrastructure (power, network, space) with no pre-installed equipment (Correct answer)
- Systems updated weekly to mirror production
- Shared facilities with another company's live operations
Correct answer: Basic infrastructure (power, network, space) with no pre-installed equipment
A cold site provides only basic utilities and physical space; the organization must procure and install all equipment before it can be used.
Question 5: Which approach BEST ensures that supply chain disruptions are addressed in recovery planning?
- Listing all suppliers in the BCP contact directory
- Identifying critical suppliers, assessing their resilience, and developing alternate sourcing strategies (Correct answer)
- Requiring all suppliers to carry business interruption insurance
- Auditing supplier financial statements annually
Correct answer: Identifying critical suppliers, assessing their resilience, and developing alternate sourcing strategies
Effective supply chain recovery planning requires understanding supplier dependencies, assessing their resilience, and establishing pre-qualified alternatives.
Question 6: In the context of recovery planning, 'Resource Requirements' documentation should capture:
- Only the IT systems needed during recovery
- Personnel, technology, facilities, vital records, and vendor services required at each recovery phase (Correct answer)
- The budget allocated to the recovery program
- Historical incident data and lessons learned
Correct answer: Personnel, technology, facilities, vital records, and vendor services required at each recovery phase
Resource requirements must comprehensively cover all categoriesāpeople, technology, space, records, and suppliersāneeded at each phase of recovery.
Question 7: A recovery strategy that relies on 'reciprocal agreements' between two companies carries which SIGNIFICANT risk?
- Regulatory non-compliance with data privacy laws
- The partner organization may also be affected by the same regional disaster (Correct answer)
- Higher cost compared to dedicated commercial recovery sites
- Difficulty obtaining executive approval
Correct answer: The partner organization may also be affected by the same regional disaster
Reciprocal agreements may fail in regional disasters because both parties can be affected simultaneously, leaving neither able to support the other.
CRP Recovery Strategy & Planning 3
A company's IT recovery strategy specifies replication to a cloud provider.
Which risk must be explicitly addressed in the plan?