Technology Recovery Procedures Flashcards

What is the purpose of conducting a 'lessons learned' review after a disaster recovery exercise?

Answer: To identify gaps and improvements so the DR plan and procedures can be updated

Lessons learned reviews systematically capture what worked, what failed, and what can be improved, driving continuous improvement of the DR program.

Which of the following is a key characteristic of a 'hot site'?

Answer: Is fully equipped and operational, able to take over within minutes to hours

A hot site mirrors the primary data center with live, synchronized systems that can assume production workloads within minutes to a few hours of a disaster declaration.

When an organization recovers technology systems at an alternate site, what must be verified before resuming full operations?

Answer: That data integrity is confirmed and recovered systems are functioning correctly

Before resuming full operations, teams must validate data integrity and confirm all recovered systems are functioning correctly to avoid processing corrupt or incomplete data.

What role does network configuration documentation play in technology recovery?

Answer: It enables recovery teams to quickly re-establish network connectivity and routing at the recovery site

Accurate network configuration documentation allows recovery teams to replicate IP addressing, routing, firewall rules, and DNS settings at the recovery site without guessing.

Which statement best describes the 3-2-1 backup rule?

Answer: Keep 3 copies of data, on 2 different media types, with 1 copy offsite

The 3-2-1 rule recommends three total copies of data, stored on two different media types, with one copy maintained at an offsite location to protect against local disasters.

Why should technology recovery procedures be written at a level that can be executed by someone unfamiliar with the specific system?

Answer: To ensure recovery can proceed even if key personnel are unavailable during the disaster

Disasters often occur when key staff are unavailable, so clear, detailed procedures enable other qualified personnel to execute recovery without system-specific expertise.

What is 'cyber recovery' and how does it differ from traditional disaster recovery?

Answer: Cyber recovery specifically addresses restoring systems and data after a cyberattack, including ensuring backups are not infected before restoring

Cyber recovery addresses the unique challenge of recovering from attacks like ransomware, requiring clean, verified backups and careful sequencing to avoid re-infecting restored systems.