SOC Business Continuity and Disaster Recovery 1 — Questions and Answers
Question 1: In disaster recovery planning, what does RPO (Recovery Point Objective) define?
- The maximum acceptable amount of data loss measured in time (Correct answer)
- The time required to restore all systems after a disaster
- The physical location designated for disaster recovery operations
- The sequence of steps for restoring systems in priority order
Correct answer: The maximum acceptable amount of data loss measured in time
RPO defines the maximum acceptable amount of data loss measured in time, directly guiding how frequently backups must occur.
Question 2: Which SOC 2 Trust Services Criterion is most directly supported by business continuity planning?
- Confidentiality
- Availability (Correct answer)
- Privacy
- Processing Integrity
Correct answer: Availability
The Availability criterion requires that systems are available for operation as committed, making BCP essential to satisfying it.
Question 3: A 'hot site' in disaster recovery planning is best described as:
- A backup facility requiring 48 to 72 hours to become fully operational
- A leased facility with only basic infrastructure and no pre-installed systems
- A fully equipped and operational backup facility with real-time data replication (Correct answer)
- A cloud-based archive for storing encrypted backup snapshots
Correct answer: A fully equipped and operational backup facility with real-time data replication
A hot site is a fully operational duplicate environment with real-time data synchronization, enabling near-immediate failover.
Question 4: What is the primary output of a Business Impact Analysis (BIA)?
- A revised vendor contract with updated SLAs
- A financial projection of quarterly recovery costs
- A list of cybersecurity vulnerabilities in production systems
- A prioritized list of critical business functions and their maximum tolerable downtime (Correct answer)
Correct answer: A prioritized list of critical business functions and their maximum tolerable downtime
A BIA identifies critical business functions, their interdependencies, and the maximum tolerable downtime for each, forming the foundation of a BCP.
Question 5: During a SOC 2 audit, which evidence would best demonstrate effective disaster recovery controls?
- Documented DR test results, including identified gaps and completed remediation actions (Correct answer)
- The organization's cyber liability insurance policy declarations page
- Customer testimonials about the organization's historical service reliability
- Vendor invoices for backup hardware and off-site storage services
Correct answer: Documented DR test results, including identified gaps and completed remediation actions
Documented DR test results with evidence of remediation demonstrate that controls are operating effectively, which is the standard of proof in a SOC 2 engagement.
Question 6: What does RTO (Recovery Time Objective) define in a disaster recovery plan?
- The maximum acceptable data loss expressed as a duration before the incident
- The maximum time allowed to restore a system or process after a disruption (Correct answer)
- The total cost budgeted for disaster recovery operations annually
- The percentage of systems that must be operational to resume business
Correct answer: The maximum time allowed to restore a system or process after a disruption
RTO defines the maximum time within which a system or business process must be restored after a disruption to avoid unacceptable consequences.
Question 7: A tabletop exercise in business continuity planning is best described as:
- A full-scale technical test that activates failover systems in a live environment
- A certification audit conducted by a third-party assessor of the DR plan
- A structured, discussion-based simulation where teams walk through disaster scenarios (Correct answer)
- A quarterly infrastructure review that validates backup integrity and restore times
Correct answer: A structured, discussion-based simulation where teams walk through disaster scenarios
A tabletop exercise is a low-cost, discussion-based simulation that allows teams to identify gaps in DR procedures without activating actual recovery systems.
SOC Business Continuity and Disaster Recovery 1
In disaster recovery planning, what does RPO (Recovery Point Objective) define?