CSX Recover and Sustain Operations 2

Question 1

During a ransomware recovery, the team discovers backups are also encrypted. What should have been in place to prevent this?

Accepted Answer

Air-gapped or immutable backup storage

Answer

Air-gapped or immutable backups are isolated from the network so ransomware cannot reach and encrypt them.

Question 2

Which metric measures the maximum tolerable duration of a disruption before significant business impact occurs?

Accepted Answer

Maximum Tolerable Downtime (MTD)

Answer

Maximum Tolerable Downtime (MTD) defines the longest an organization can survive without a critical function before impacts become unacceptable.

Question 3

What is the PRIMARY purpose of a post-incident review (PIR) in the context of sustaining operations?

Accepted Answer

To identify lessons learned and improve future response

Answer

Post-incident reviews focus on identifying what worked, what didn't, and how processes can be improved to strengthen future response.

Question 4

A business continuity plan (BCP) differs from a disaster recovery plan (DRP) in that the BCP primarily focuses on:

Accepted Answer

Maintaining critical business functions during a disruption

Answer

A BCP covers maintaining essential business operations during any disruption, while a DRP specifically addresses IT system recovery.

Question 5

Which recovery strategy involves shifting operations to a fully equipped, immediately operational alternate site?

Accepted Answer

Hot site

Answer

A hot site is a fully equipped alternate facility with up-to-date data and systems that can take over operations immediately.

(CSX) Cybersecurity Nexus Certification Practice Test