CSL CSL Business Continuity & Disaster Recovery Planning 1 — Questions and Answers
Question 1: What is the primary purpose of a Business Continuity Plan (BCP)?
- To document all IT system configurations for auditors
- To ensure critical business functions can continue during and after a disruption (Correct answer)
- To assign blame and accountability following a security incident
- To comply with insurance policy requirements after a disaster
Correct answer: To ensure critical business functions can continue during and after a disruption
A BCP is designed to ensure that critical business operations can continue during and recover from a disruptive event, minimizing operational and financial impact.
Question 2: What does RTO (Recovery Time Objective) define in disaster recovery?
- The maximum amount of data loss an organization can tolerate
- The total cost of recovering from a disaster
- The maximum acceptable time to restore a system or process after a disruption (Correct answer)
- The frequency at which data backups must be performed
Correct answer: The maximum acceptable time to restore a system or process after a disruption
RTO defines the maximum tolerable duration of downtime — the target time within which a business process must be restored after a disaster.
Question 3: A Business Impact Analysis (BIA) is conducted primarily to:
- Identify which employees are essential during a crisis
- Determine the financial and operational impact of disruptions to critical processes (Correct answer)
- Audit compliance with NIST cybersecurity frameworks
- Evaluate vendor SLAs for third-party services
Correct answer: Determine the financial and operational impact of disruptions to critical processes
A BIA identifies critical business functions and quantifies the financial and operational consequences of their disruption, forming the foundation of any BCP.
Question 4: Which recovery site type provides fully operational systems and data that can be activated immediately in a disaster?
- Cold site
- Warm site
- Hot site (Correct answer)
- Mobile site
Correct answer: Hot site
A hot site is a fully operational duplicate facility with real-time or near-real-time data replication, allowing immediate failover with minimal downtime.
Question 5: Who should hold ultimate ownership and accountability for the Business Continuity Plan?
- The Chief Information Officer (CIO)
- The IT Disaster Recovery Team Lead
- Senior executive leadership, typically the CEO or Board (Correct answer)
- The Chief Information Security Officer (CISO)
Correct answer: Senior executive leadership, typically the CEO or Board
BCP is a business function, not just an IT function; ultimate ownership belongs to senior executive leadership or the Board, who are accountable for organizational resilience.
Question 6: What is the primary purpose of a tabletop exercise in business continuity?
- To test the physical failover of systems to a backup data center
- To train new employees on their roles and responsibilities
- To walk stakeholders through a simulated disaster scenario to identify gaps and validate plans (Correct answer)
- To verify that data backups are complete and restorable
Correct answer: To walk stakeholders through a simulated disaster scenario to identify gaps and validate plans
A tabletop exercise is a discussion-based simulation where key stakeholders walk through a hypothetical scenario to evaluate response plans and identify weaknesses without disrupting operations.
Question 7: RPO (Recovery Point Objective) is best described as:
- The time required to restore systems to full capacity
- The acceptable amount of data loss measured in time (Correct answer)
- The priority order in which systems are restored
- The minimum staffing level needed during a disaster
Correct answer: The acceptable amount of data loss measured in time
RPO defines the maximum period of data loss that an organization can tolerate, expressed as a time interval (e.g., 4 hours of data loss is acceptable), which drives backup frequency decisions.
CSL CSL Business Continuity & Disaster Recovery Planning 1
What is the primary purpose of a Business Continuity Plan (BCP)?