NAB Risk Assessment & Mitigation 3 — Questions and Answers
Question 1: A broadcast network's business continuity plan (BCP) should be tested at minimum:
- Once every five years during low-traffic periods
- Only after an actual incident has occurred
- Annually through tabletop exercises or live drills (Correct answer)
- Whenever new equipment is purchased
Correct answer: Annually through tabletop exercises or live drills
Regular annual testing — through tabletop exercises, simulations, or full drills — ensures the BCP remains effective and staff remain familiar with procedures.
Question 2: Which metric measures the maximum acceptable length of time a broadcast system can be offline after a failure before causing unacceptable business impact?
- Recovery Point Objective (RPO)
- Mean Time to Repair (MTTR)
- Recovery Time Objective (RTO) (Correct answer)
- Mean Time Between Failures (MTBF)
Correct answer: Recovery Time Objective (RTO)
Recovery Time Objective (RTO) defines the maximum tolerable downtime before resuming normal operations after a disruption.
Question 3: A radio station stores backup recordings of all broadcasts. The Recovery Point Objective (RPO) governs which aspect of this practice?
- How quickly backup files can be restored to air
- The maximum age of data that can be lost before the loss is unacceptable (Correct answer)
- The physical location where backups are stored
- The number of backup copies maintained
Correct answer: The maximum age of data that can be lost before the loss is unacceptable
RPO defines the acceptable data loss window — essentially, how far back in time the organization can tolerate losing data.
Question 4: A broadcast facility establishes a hot standby site with real-time data replication. This redundancy strategy primarily minimizes:
- Capital expenditure on new equipment
- Recovery Time Objective (RTO) and Recovery Point Objective (RPO) (Correct answer)
- Staff training requirements during emergencies
- Regulatory compliance documentation
Correct answer: Recovery Time Objective (RTO) and Recovery Point Objective (RPO)
A hot standby with real-time replication minimizes both RTO (near-instant failover) and RPO (minimal or no data loss).
Question 5: When assessing the risk of a transmitter fire, which formula is used to calculate the risk level?
- Risk = Threat × Asset Value
- Risk = Likelihood × Impact (Correct answer)
- Risk = Vulnerability ÷ Control Effectiveness
- Risk = Frequency × Detection Rate
Correct answer: Risk = Likelihood × Impact
The standard risk calculation multiplies the probability (likelihood) of an event by its potential impact to yield the overall risk level.
Question 6: Which standard provides internationally recognized guidance for information security risk management applicable to broadcast IT infrastructure?
- ISO/IEC 27005 (Correct answer)
- FCC Part 73
- NFPA 72
- ATSC A/85
Correct answer: ISO/IEC 27005
ISO/IEC 27005 is the international standard specifically focused on information security risk management processes and best practices.
Question 7: A broadcast station implements dual power feeds from separate utility substations to reduce transmitter downtime risk. This is an example of:
- Risk avoidance
- Risk acceptance
- Risk mitigation through redundancy (Correct answer)
- Risk transfer to the utility provider
Correct answer: Risk mitigation through redundancy
Adding redundant power feeds reduces the likelihood and impact of a power failure, which is a classic mitigation strategy using redundancy.
NAB Risk Assessment & Mitigation 3
A broadcast network's business continuity plan (BCP) should be tested at minimum: