Recover and Sustain Operations Flashcards

Which term describes the process of verifying that restored systems are functioning correctly and securely before returning them to production?

Answer: Validation testing

Validation testing confirms that restored systems meet functional and security requirements before they are returned to normal production use.

A company's DRP specifies that the IT team must be notified within 15 minutes of a declared disaster. This is an example of:

Answer: Escalation procedure

Escalation procedures define who must be notified, in what order, and within what time frame when an incident or disaster is declared.

During a full-interruption test of a disaster recovery plan, what happens to the primary systems?

Answer: They are shut down and all operations shift to the recovery site

A full-interruption test actually shuts down primary systems and moves operations entirely to the recovery site, making it the most realistic but highest-risk test type.

Which of the following BEST supports long-term sustainability of security operations after an incident?

Answer: Integrating lessons learned into updated policies, training, and controls

Sustaining operations requires feeding lessons learned back into policies, training, and technical controls to prevent recurrence and improve maturity.

What is the role of a 'recovery coordinator' during a disaster recovery activation?

Answer: To oversee and direct recovery activities and ensure procedures are followed

The recovery coordinator manages and directs the overall recovery effort, ensuring that teams follow the plan and activities proceed in the correct sequence.

Which backup rotation scheme ensures that backups are retained across daily, weekly, and monthly intervals using a minimal number of media sets?

Answer: Grandfather-Father-Son (GFS)

The Grandfather-Father-Son (GFS) scheme uses daily (Son), weekly (Father), and monthly (Grandfather) backup sets to balance retention coverage with media efficiency.

An organization's critical system has an RTO of 2 hours but a hot site failover consistently takes 4 hours in tests. What should the organization do?

Answer: Invest in automation and pre-provisioning to close the gap

When actual recovery time exceeds the RTO, the organization must invest in improving the process — through automation, pre-staging, or staffing — to meet the objective.