SSCP Certification SSCP Business Continuity and Disaster Recovery 1 — Questions and Answers
Question 1: What is the primary purpose of a Business Continuity Plan (BCP)?
- To prevent all security incidents from occurring
- To ensure critical business functions continue during and after a disaster (Correct answer)
- To document all IT assets and configurations
- To establish baseline network security policies
Correct answer: To ensure critical business functions continue during and after a disaster
A BCP is designed to ensure that critical business operations can continue or be quickly restored during and after a disruption, minimizing downtime and financial loss.
Question 2: What does Recovery Time Objective (RTO) define?
- The maximum acceptable amount of data loss measured in time
- The cost budget allocated for disaster recovery operations
- The maximum acceptable time to restore a system or process after a failure (Correct answer)
- The point-in-time to which data must be restored after a disruption
Correct answer: The maximum acceptable time to restore a system or process after a failure
RTO defines the maximum acceptable duration for restoring operations after a disruption, setting the target time within which systems must be recovered.
Question 3: What does Recovery Point Objective (RPO) define?
- The maximum acceptable time to restore a system after a failure
- The maximum acceptable amount of data loss expressed as a point in time (Correct answer)
- The physical location where recovery operations are conducted
- The total financial cost of recovering from a disaster
Correct answer: The maximum acceptable amount of data loss expressed as a point in time
RPO defines the maximum acceptable amount of data loss measured in time, indicating the point to which data must be restored after a disaster.
Question 4: What is a Business Impact Analysis (BIA)?
- A financial audit of business operations and revenue streams
- A process that identifies critical business functions and the impact of their disruption (Correct answer)
- An assessment of physical security vulnerabilities at business locations
- A review of employee performance and response during past incidents
Correct answer: A process that identifies critical business functions and the impact of their disruption
A BIA identifies critical business functions, their dependencies, and the potential financial and operational impact of disruptions, forming the foundation of effective BCP.
Question 5: What is a 'hot site' in the context of disaster recovery?
- A fully equipped backup facility that can assume operations immediately after a disaster (Correct answer)
- A partially equipped facility that requires some setup time before becoming operational
- An empty facility with only basic power and network infrastructure
- A mobile recovery unit deployed directly to the disaster location
Correct answer: A fully equipped backup facility that can assume operations immediately after a disaster
A hot site is a fully equipped, operational duplicate facility with current data replication that can assume business operations immediately after a disaster is declared.
Question 6: What is Maximum Tolerable Downtime (MTD)?
- The time required to restore systems from backup media
- The longest period a critical business function can be unavailable before causing irreparable damage (Correct answer)
- The duration of pre-approved maintenance windows for system updates
- The time elapsed between disaster occurrence and formal declaration
Correct answer: The longest period a critical business function can be unavailable before causing irreparable damage
MTD (also called Maximum Tolerable Period of Disruption) is the absolute maximum time a critical business function can remain offline before the organization suffers unacceptable or irreversible harm.
Question 7: What is the correct sequence for developing a Business Continuity Plan?
- Documentation, testing, implementation, risk planning
- Business Impact Analysis, risk assessment, strategy development, plan implementation (Correct answer)
- Risk assessment, documentation, employee training, testing
- Planning, implementation, BIA, and then final testing
Correct answer: Business Impact Analysis, risk assessment, strategy development, plan implementation
BCP development follows: BIA (identify critical functions) → risk assessment (identify threats) → strategy development (define recovery options) → plan implementation and testing.
SSCP Certification SSCP Business Continuity and Disaster Recovery 1
What is the primary purpose of a Business Continuity Plan (BCP)?