SSP Business Continuity & Resilience 4 — Questions and Answers
Question 1: A full-scale disaster recovery exercise results in missing the RTO by 6 hours. What is the MOST appropriate immediate next step?
- Extend the official RTO to match the actual recovery time
- Conduct an after-action review to identify and remediate gaps causing the delay (Correct answer)
- Declare the exercise a failure and cancel future tests
- Replace the DR team with external consultants
Correct answer: Conduct an after-action review to identify and remediate gaps causing the delay
An after-action review identifies the specific process, technology, or staffing gaps that caused the RTO miss, enabling targeted improvements.
Question 2: Which type of business impact analysis (BIA) output directly informs the selection of recovery strategies?
- List of all organizational assets
- Criticality rankings and recovery time/point objectives for each function (Correct answer)
- Budget allocation for the continuity program
- Staff contact directory for incident response
Correct answer: Criticality rankings and recovery time/point objectives for each function
Criticality rankings combined with RTO and RPO values tell planners which functions must be recovered first and how quickly, driving strategy selection.
Question 3: Which scenario represents a violation of the principle of 'geographic separation' in resilience planning?
- Primary and backup data centers located 500 miles apart
- Hot site and primary office share the same power grid substation (Correct answer)
- Cloud backup stored in a different region than production
- Alternate operations center in a different state
Correct answer: Hot site and primary office share the same power grid substation
Sharing a power grid substation means both facilities are vulnerable to the same single point of failure, violating true geographic separation.
Question 4: An organization's continuity plan assigns 'Mission Essential Functions' (MEFs). Which criterion BEST qualifies a function as mission essential?
- It generates the highest revenue under normal conditions
- Its disruption would immediately prevent the organization from fulfilling its core legal or operational mandate (Correct answer)
- It requires the most personnel to operate
- It is the most technically complex system in the environment
Correct answer: Its disruption would immediately prevent the organization from fulfilling its core legal or operational mandate
MEFs are functions whose interruption would critically impair the organization's ability to meet its core mission or legal obligations.
Question 5: What is the purpose of a Continuity of Government (COG) plan at the federal level?
- To ensure tax collection continues during a recession
- To maintain the constitutional authority and essential functions of government during a catastrophic emergency (Correct answer)
- To regulate private sector business continuity standards
- To coordinate international disaster relief efforts
Correct answer: To maintain the constitutional authority and essential functions of government during a catastrophic emergency
COG plans ensure that the executive, legislative, and judicial branches can continue to operate and exercise constitutional authority during a national emergency.
Question 6: A company stores its only BCP document copy in the primary headquarters building. Why is this problematic?
- It creates a regulatory compliance violation
- The plan may be inaccessible precisely when it is needed most — during a disaster affecting that building (Correct answer)
- It reduces response speed during incidents
- It prevents external auditors from reviewing the plan
Correct answer: The plan may be inaccessible precisely when it is needed most — during a disaster affecting that building
If the primary facility is the disaster site, storing the only copy there ensures the plan is unavailable when it is most critical.
Question 7: Which recovery strategy involves contracting with an external organization to perform specific business functions if an internal disruption occurs?
- Cold site activation
- Manual fallback procedures
- Business Process Outsourcing (BPO) contingency arrangement (Correct answer)
- Mutual aid agreement
Correct answer: Business Process Outsourcing (BPO) contingency arrangement
A BPO contingency arrangement pre-arranges for a third party to assume specific operational functions during a disruption, maintaining service continuity.
SSP Business Continuity & Resilience 4
A full-scale disaster recovery exercise results in missing the RTO by 6 hours.
What is the MOST appropriate immediate next step?