Business Continuity and Disaster Recovery Flashcards
6 cards from real ISC2 CC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Business Continuity and Disaster Recovery flashcards as text
What is the primary objective of incident response?
Answer: Minimizing the impact of security incidents and restoring operations
Incident response aims to contain and minimize the damage caused by security incidents while restoring normal operations as quickly as possible.
Which phase of incident response involves identifying what happened and its scope?
Answer: Detection and Analysis
The detection and analysis phase involves identifying security events, determining if they are incidents, and understanding the scope of impact.
What is the purpose of the containment phase in incident response?
Answer: To stop the spread of the incident and limit further damage
Containment focuses on stopping the spread of an incident to prevent additional damage while preserving evidence for analysis.
What is a tabletop exercise in business continuity planning?
Answer: A discussion-based exercise where participants walk through a hypothetical scenario
A tabletop exercise is a discussion-based session where stakeholders talk through responses to a hypothetical scenario without making actual system changes.
Which step comes AFTER eradication in the standard incident response process?
Answer: Recovery
After eradicating the threat, the next step is recovery — restoring affected systems and verifying they are operating normally.
What is the purpose of an after-action report (AAR) following a security incident?
Answer: To document what happened, what worked, and what needs improvement
An after-action report documents the incident timeline, response effectiveness, and lessons learned to improve future incident handling.