SSP Business Continuity & Resilience 3 — Questions and Answers
Question 1: Which international standard specifically provides guidance for Business Continuity Management Systems (BCMS)?
- ISO 27001
- ISO 22301 (Correct answer)
- NIST SP 800-53
- ISO 31000
Correct answer: ISO 22301
ISO 22301 is the international standard that specifies requirements for planning, implementing, maintaining, and improving a BCMS.
Question 2: A BIA reveals that a customer billing system has an RPO of 4 hours. Which backup strategy best satisfies this requirement?
- Daily full backups at midnight
- Weekly incremental backups
- Continuous data replication or backups every 2 hours (Correct answer)
- Monthly full system snapshots
Correct answer: Continuous data replication or backups every 2 hours
To meet a 4-hour RPO, backups must occur at intervals shorter than 4 hours, making continuous replication or 2-hour backups the appropriate strategy.
Question 3: What is the primary purpose of an Alternate Operating Facility (AOF) in a continuity of operations plan?
- To permanently replace the primary facility after a disaster
- To house non-essential staff during normal operations
- To provide a pre-identified location from which essential functions can be performed during a disruption (Correct answer)
- To store off-site backups and archival data
Correct answer: To provide a pre-identified location from which essential functions can be performed during a disruption
An AOF is a designated backup location where critical personnel and functions can operate when the primary facility is unavailable.
Question 4: During recovery operations, a team discovers the documented recovery procedures are outdated and incomplete. What is the root cause failure this exposes?
- Insufficient staffing during the incident
- Failure to maintain and regularly test the BCP (Correct answer)
- Inadequate funding for recovery resources
- Poor communication with executive leadership
Correct answer: Failure to maintain and regularly test the BCP
Outdated procedures indicate the BCP was not regularly reviewed, updated, and tested — a core maintenance failure in the continuity program lifecycle.
Question 5: Which term describes the process of redistributing risk to a third party, such as through insurance or contractual agreements?
- Risk acceptance
- Risk mitigation
- Risk transfer (Correct answer)
- Risk avoidance
Correct answer: Risk transfer
Risk transfer shifts the financial or operational burden of a risk to another party, commonly through insurance policies or vendor contracts.
Question 6: A security practitioner is developing a pandemic plan. Which continuity strategy is most critical to address in this scenario?
- Alternate data center activation
- Remote work capability and workforce redundancy (Correct answer)
- Physical security perimeter hardening
- Supply chain diversification for hardware
Correct answer: Remote work capability and workforce redundancy
Pandemics primarily affect personnel availability, making remote work capabilities and workforce redundancy the central continuity strategies.
Question 7: In continuity planning, what does 'order of succession' refer to?
- The sequence in which systems are restored after an outage
- A pre-established hierarchy of individuals authorized to assume leadership roles if primary leaders are incapacitated (Correct answer)
- The priority order for reconstituting business units
- The chronological timeline for implementing recovery procedures
Correct answer: A pre-established hierarchy of individuals authorized to assume leadership roles if primary leaders are incapacitated
Order of succession designates who assumes authority and decision-making responsibility when key leaders are unavailable during a disruption.
SSP Business Continuity & Resilience 3
Which international standard specifically provides guidance for Business Continuity Management Systems (BCMS)?