Cyber Security Quiz: Business Continuity And Disaster Recovery

10 questions · exam conditions

0:00

Business Continuity And Disaster RecoveryQuestion 1 of 10

A business impact analysis assigns a claims portal a maximum tolerable downtime of five hours and a recovery time objective of four hours. The portal depends on the corporate identity service and the network. Current recovery plans assign the identity service a recovery time objective of six hours and the network a recovery time objective of two hours. The business confirms that the portal cannot operate in a degraded mode without identity services.

Which change BEST resolves the inconsistency in the recovery strategy?

Increase the portal recovery time objective to six hours so it matches the identity service objective.

Reduce the identity service objective to four hours or less and recover it before the portal.

Recover the portal after the network and restore identity services once portal access has resumed.

Set the identity service recovery point objective to four hours and retain its current recovery sequence.

← Back to quizzes

Cyber Security Quiz

Cyber Security Quiz: Business Continuity And Disaster Recovery

Practice Business Continuity And Disaster Recovery in Cyber Security with focused quiz questions that help you check what you know, review explanations, and build confidence with test-style prompts.

What this quiz covers

This quiz focuses on Business Continuity And Disaster Recovery, giving you a quick way to practice the rules, question types, and explanations that matter most for Cyber Security.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

All questions

Question 1

Which change BEST resolves the inconsistency in the recovery strategy?

Increase the portal recovery time objective to six hours so it matches the identity service objective.
Reduce the identity service objective to four hours or less and recover it before the portal. (correct answer)
Recover the portal after the network and restore identity services once portal access has resumed.
Set the identity service recovery point objective to four hours and retain its current recovery sequence.

Explanation: When recovery planning involves dependent systems, you must ensure that each dependency can be recovered within the time budget of the system that relies on it. Think of it like a pipeline: if System A needs System B to function, System B's RTO must be less than or equal to System A's RTO — and both must fit inside the maximum tolerable downtime (MTD). Here, the portal has an MTD of five hours and an RTO of four hours. The identity service is a hard dependency (no degraded mode), meaning the identity service must be fully restored before the portal can recover. That means the identity service's RTO must be four hours or less — leaving enough time for the portal itself to complete recovery within the four-hour window and stay under the five-hour MTD. Answer B correctly identifies this: reduce the identity service RTO to four hours or less and sequence it before the portal. This resolves the core inconsistency. Answer A fails because raising the portal's RTO to six hours pushes recovery past the five-hour MTD — you'd be violating the business requirement entirely. Answer C is operationally backwards: you cannot restore the portal before its dependency; recovering the portal first while deferring identity services ignores the stated hard dependency. Answer D confuses RTO with RPO (recovery point objective, which measures data loss tolerance, not system restoration time) — changing the RPO does nothing to fix a sequencing or timing conflict. The key study tip: always map dependency chains before assigning RTOs. A dependent system's RTO can never exceed the RTO of its critical dependencies.

Question 2

An organization requires no more than one hour of data loss for a financial application. It currently maintains a continuously updated replica in the same administrative environment and immutable backups every four hours. A recent ransomware simulation showed that malicious encryption could remain undetected for three hours and would be copied to the replica.

Which recommendation BEST addresses both the recovery point objective and the ransomware scenario?

Retain only the continuous replica because its frequent updates provide the smallest possible recovery point.
Create immutable restore points at least hourly and retain them beyond the likely detection window. (correct answer)
Keep four-hour immutable backups but conduct recovery exercises every hour to verify their availability.
Move the continuous replica to another region while retaining the same credentials and replication process.

Explanation: When a question combines a Recovery Point Objective (RPO) with a ransomware resilience requirement, you need to evaluate both dimensions together — a solution that satisfies one but not the other is incomplete. RPO defines the maximum acceptable data loss window, while ransomware defense requires backups that exist outside the attack's reach and before the infection timeline. Here, the organization's RPO is one hour, and ransomware can lurk undetected for three hours before triggering. That three-hour window is the critical threat: any backup within that window may already be compromised. The ideal solution needs restore points frequent enough to honor the one-hour RPO and retained long enough to reach back before the infection began. B is correct because creating immutable restore points at least hourly satisfies the one-hour RPO directly, and retaining them beyond the three-hour detection window ensures at least one clean, unencrypted restore point exists before the ransomware activated. Immutability prevents the attacker from corrupting the backups themselves. A fails because the continuous replica sits in the same administrative environment and replicates changes in real time — including malicious encryption. It will faithfully copy the ransomware damage and offers no clean recovery point. C fails because running recovery exercises more frequently doesn't change the fundamental problem: the four-hour backup interval already violates the one-hour RPO. Exercising a non-compliant backup more often doesn't make it compliant. D fails because moving the replica to another region addresses geographic redundancy, not the core vulnerability. Keeping the same credentials and replication process means ransomware encryption still propagates to the replica unchanged. On exam questions pairing RPO with ransomware, always ask: "Is the backup both frequent enough and isolated enough to survive the attack window?" Both conditions must be true simultaneously.

Question 3

A call center's continuity requirements specify that at least sixty percent of normal call volume must be handled within six hours of a disruption. Full service must be restored within twenty-four hours. The proposed plan provides manual procedures that reach forty percent capacity after four hours and restores automated processing to full capacity after twenty hours.

Which conclusion about the proposed plan is MOST accurate?

The plan satisfies both requirements because some service resumes before six hours and full service returns before twenty-four.
The plan misses the minimum operating requirement even though it achieves full restoration within the recovery target. (correct answer)
The plan misses the full-restoration target because manual operations begin before automated processing is available.
The plan satisfies the minimum operating requirement because forty percent capacity is restored two hours early.

Explanation: When evaluating a business continuity plan, you must check each requirement independently against what the plan actually delivers — not just whether the plan looks generally successful. Two metrics matter here: the minimum operating threshold (what percentage of service must be running, and by when) and the full-restoration target (when must complete service return). The passage states the plan must handle at least 60% of normal call volume within six hours. The proposed plan delivers only 40% capacity after four hours. That 40% figure never reaches 60% before automated processing is restored at the 20-hour mark. So despite restoring full service within the 24-hour window, the plan fails the minimum operating requirement — it doesn't reach the 60% threshold within six hours. That makes B correct: the plan misses the interim capacity target while still meeting the full-restoration deadline. A is wrong because "some service resumes before six hours" misreads the requirement. The threshold isn't simply any service — it's sixty percent of capacity. Forty percent doesn't satisfy that bar. C is wrong on two levels: the full-restoration target (24 hours) is actually met at 20 hours, and the reasoning about manual operations causing the miss is a fabrication — the plan fails the capacity threshold, not the restoration deadline. D is wrong because forty percent capacity is not the same as the required sixty percent. Restoring service two hours early is irrelevant if you haven't hit the minimum volume threshold. Study tip: On continuity-planning questions, always map each plan metric to its specific requirement. Meeting one target never automatically satisfies another.

Question 4

A business requires a recovery time of no more than twelve hours and a recovery point of no more than four hours. A cold site can restore service in thirty hours from daily backups. A warm site can restore systems in ten hours using two-hour replication, but a network circuit ordered after an incident would require fourteen hours. Preprovisioning the circuit adds a modest recurring cost. A hot site can recover in two hours with near-current data but costs substantially more.

Which strategy is the MOST cost-effective option that satisfies the stated objectives?

Use the cold site with daily backups because it has the lowest ongoing operating cost.
Use the warm site and order its network circuit after the disaster has been formally declared.
Use the warm site with a preprovisioned circuit and retain the existing two-hour replication. (correct answer)
Use the hot site with synchronous replication because it provides the fastest possible recovery.

Explanation: When evaluating disaster recovery strategies, you need to check two thresholds simultaneously: the Recovery Time Objective (RTO) — how quickly systems must be back online — and the Recovery Point Objective (RPO) — how recent the restored data must be. Here, RTO ≤ 12 hours and RPO ≤ 4 hours. Once you've confirmed a solution meets both constraints, you look for the least expensive option that clears them. The warm site with a preprovisioned circuit (C) is the right answer. Its replication interval is 2 hours, which satisfies the 4-hour RPO. With the circuit already in place, recovery completes in 10 hours — inside the 12-hour RTO. The only added cost is a modest recurring circuit fee, making it far cheaper than a hot site. Choice A fails immediately on both metrics. The cold site takes 30 hours to restore service (violates RTO) and uses daily backups (violates the 4-hour RPO). Low cost is irrelevant if the solution doesn't meet the requirements. Choice B is a subtle trap. The warm site's systems recover in 10 hours, but ordering the network circuit after declaration adds 14 hours of circuit provisioning time, pushing total recovery time to 24 hours — well past the 12-hour RTO. The replication satisfies RPO, but the circuit delay breaks RTO. Choice D meets every technical requirement but at substantially higher cost when a cheaper option already works. On cost-effectiveness questions, "fastest possible" is overkill if a less expensive solution already satisfies all stated objectives. Study tip: Always validate RTO and RPO independently before comparing costs — a cheaper solution that fails either threshold is never the right answer, no matter how attractive the price.

Question 5

An organization has completed several tabletop exercises for its disaster recovery plan. Those exercises confirmed that team members understand their roles, but management now wants evidence that systems can actually be restored at the recovery facility using replicated data. Management will not approve an exercise that interrupts the production environment.

Which type of exercise BEST meets management's objective?

Conduct another tabletop exercise using a more complex scenario and additional executive participants.
Run a parallel recovery test at the alternate facility while production continues operating normally. (correct answer)
Perform a full-interruption test by shutting down production and transferring all users to recovery systems.
Distribute the recovery plan for individual review and collect signed acknowledgments from each participant.

Explanation: When you see a question about disaster recovery exercises, your first move should be to map the scenario to the exercise progression: plan review → tabletop → parallel test → full interruption. Each step adds more realism but also more risk and disruption. The key here is identifying which step satisfies both constraints: proving systems can actually be restored and not interrupting production. A parallel test runs recovery operations at the alternate facility simultaneously with normal production operations. This directly validates that real data can be restored on real hardware — it answers management's "can we actually recover?" question while keeping production untouched. That makes B the correct choice. A fails because another tabletop is purely discussion-based. Team members have already demonstrated they understand their roles; what's missing is proof that systems physically recover. Adding complexity or executives doesn't change what a tabletop can prove. C is a full-interruption test, which shuts down production entirely and routes users to recovery systems — the most rigorous test possible, but management explicitly ruled out any exercise that disrupts the production environment. This directly violates the stated constraint. D is simply a plan review with signatures. It confirms awareness of the plan, not operational capability. It's even less rigorous than a tabletop and provides no evidence of actual system restoration. Study tip: On disaster recovery questions, always match the exercise type to what it can and cannot prove. Tabletops prove knowledge; parallel tests prove technical restoration without risk; full-interruption tests prove end-to-end failover but carry the highest operational risk. Knowing this hierarchy will help you quickly eliminate distractors.

Question 6

Backup monitoring reports successful jobs every night. During a disaster recovery exercise, however, the organization cannot decrypt the restored database because the encryption keys were stored in the same administrative domain as the failed production environment. Previous backup tests verified file presence but never completed an application-level restoration.

Which control improvement would BEST address the underlying continuity weakness?

Increase backup frequency and continue verifying that encrypted backup files appear in the storage repository.
Disable backup encryption so restoration no longer depends on keys held by production administrators.
Escrow recovery keys separately and perform periodic end-to-end application restoration tests. (correct answer)
Replicate the encrypted backups to another region while preserving the existing key-management arrangement.

Explanation: Whenever you see a disaster recovery scenario on the exam, train yourself to identify two separate failure modes: a process gap and a dependency gap. This question contains both — and the correct fix must address both simultaneously. The scenario reveals that backups appeared healthy (files were present) but were never validated through a full application-level restore. Worse, the encryption keys lived in the same administrative domain as the failed environment, meaning a single failure wiped out both the data access mechanism and the keys needed to unlock it. Option C directly resolves both problems: escrowing recovery keys in a separate domain breaks the single-point-of-failure dependency, and requiring periodic end-to-end restoration tests ensures the organization discovers key or data issues before a real disaster — not during one. Option A is a trap because it increases the frequency of the same flawed process. Monitoring that only confirms file presence never catches decryption failures; doing it more often just multiplies the false confidence. Option B eliminates encryption entirely, which trades a continuity problem for a confidentiality catastrophe — removing a security control is almost never the right answer on a security exam. Option D sounds appealing because geographic replication adds resilience, but it explicitly preserves the existing key-management arrangement, meaning the restored backups in the new region are still unreadable without keys that failed alongside production. The study tip here: watch for answers that fix symptoms (frequency, location) while leaving the root cause intact. The best continuity controls close both a procedural gap (untested restores) and a dependency gap (co-located keys) in a single solution.

Question 7

A critical software-as-a-service vendor states that it uses multiple cloud regions, but its contract contains no recovery objectives or testing commitments. The vendor also acknowledges that many customers depend on the same standby capacity during regional failures. The organization's internal workaround can support only a limited portion of normal operations.

Which governance action BEST addresses the organization's continuity exposure?

Accept the vendor's multiregion statement because geographic redundancy is sufficient evidence of recoverability.
Require the vendor to use a single dedicated region so other customers cannot consume recovery resources.
Rely exclusively on the internal workaround because third-party recovery commitments cannot be meaningfully assessed.
Require contractual recovery objectives, test evidence, and assurance regarding shared standby capacity. (correct answer)

Explanation: When a question describes a vendor relationship with vague recovery claims and no enforceable commitments, you're being tested on third-party risk governance — specifically, how organizations should translate business continuity requirements into contractual controls rather than accepting informal assurances. The core problem here is threefold: no defined recovery objectives, no testing evidence, and shared standby capacity that may be unavailable exactly when you need it most. Option D directly attacks all three gaps by requiring contractual recovery time and recovery point objectives, documented test results proving those objectives are achievable, and explicit assurances about how shared capacity is managed during widespread regional failures. This transforms a verbal claim into an auditable, enforceable commitment. Option A is dangerously naive — geographic redundancy describes infrastructure topology, not recoverability. Having servers in two regions means nothing if failover has never been tested or if dozens of customers are competing for the same standby resources simultaneously. Option B misunderstands how cloud economics work; demanding a dedicated single region actually removes redundancy rather than securing it, and is typically neither commercially viable nor protective against regional outages. Option C essentially surrenders governance entirely — the fact that third-party commitments are difficult to assess is precisely why contracts, testing requirements, and audit rights exist. Difficulty is not a reason to abandon oversight. Study tip: On continuity and vendor risk questions, watch for answers that confuse capability with commitment. A vendor can recover quickly — but without contractual objectives and test evidence, you have no basis to plan around it. Governance means converting assumptions into enforceable, verifiable obligations.

Question 8

A retailer's hosted order-processing platform becomes unavailable. The cause and expected duration are unknown. The business continuity plan contains a tested manual order-capture procedure that can begin within thirty minutes. The disaster recovery plan permits migration to an alternate provider only after a regional provider outage is confirmed, because migration can create reconciliation problems.

What should the incident coordinator do FIRST to maintain service while limiting unnecessary recovery risk?

Invoke the manual continuity procedure while investigating whether disaster recovery activation criteria are met. (correct answer)
Migrate immediately to the alternate provider because any service outage justifies disaster recovery activation.
Wait for confirmation of a regional outage before starting either continuity or recovery procedures.
Declare the primary provider permanently unavailable and begin full return-to-normal planning immediately.

Explanation: When you see a question involving an active outage with unclear cause and duration, you should immediately think about the distinction between business continuity (keeping operations running during disruption) and disaster recovery (restoring systems, often with migration costs and complexity). Good incident management means activating the least disruptive, lowest-risk response first while continuing to gather information. That logic points directly to A. The manual order-capture procedure is already tested, can launch within thirty minutes, and preserves business operations without triggering the reconciliation risks associated with provider migration. Critically, investigating whether DR criteria are met runs in parallel — you're not ignoring recovery, you're simply not jumping to it prematurely. This is textbook continuity-first thinking. B is dangerously wrong because it assumes any outage justifies full DR activation. The passage explicitly states that migration creates reconciliation problems and should only occur after a regional outage is confirmed. Migrating immediately on an unknown, potentially short disruption could create more damage than the outage itself. C fails the business continuity test entirely. Waiting without starting any response means customers experience unnecessary service loss when a ready manual procedure exists. You never stall a tested continuity plan simply because DR criteria haven't been assessed yet — those are independent decisions. D is premature and extreme. You cannot declare a provider "permanently unavailable" minutes into an incident of unknown cause. Jumping straight to return-to-normal planning skips every intermediate step the BCP and DRP were designed to govern. Study tip: On continuity and recovery questions, always ask yourself: Does the response match what we actually know right now? Escalate proportionally — start with continuity, confirm before you activate DR.

Question 9

After a data-center outage, an organization has operated from its hot site for three days. The primary site has been rebuilt, and replication indicates that the databases are synchronized. Operations wants to return immediately, but security controls at the rebuilt site have not been validated, and the failback procedure has not been rehearsed since a major network redesign.

What is the BEST next step before returning production to the primary site?

Fail back immediately because database synchronization is sufficient evidence that the primary site is ready.
Stop replication first and allow each site to process transactions before selecting the healthier database.
Keep the hot site permanently active because any failback creates unacceptable continuity risk.
Validate technical and security controls, then perform a coordinated failback with rollback criteria. (correct answer)

Explanation: Failback planning sits at the intersection of business continuity and security governance — and exam questions like this test whether you understand that "technically ready" and "operationally ready" are two different things. When you see a scenario involving a return to a primary site after a disaster, mentally check two boxes: have controls been validated, and has the procedure been rehearsed? Option D is correct because it addresses both gaps the passage explicitly identifies — unvalidated security controls and an unrehearsed failback procedure following a major network redesign. Returning to the primary site without validating controls could expose the organization to vulnerabilities that didn't exist before the rebuild. Including defined rollback criteria means that if failback fails or introduces new issues, the team has a predetermined decision point to revert to the hot site safely. This is disciplined, risk-aware recovery practice. Option A is the most tempting trap: database synchronization confirms data integrity, but it says nothing about whether firewalls, access controls, IDS sensors, or patching are properly configured on the rebuilt site. Don't conflate data readiness with security readiness. Option B describes a split-brain scenario — allowing both sites to independently process transactions before picking a "winner." This creates data divergence and potential corruption, which is precisely what replication is designed to prevent. It introduces the very problem you're trying to avoid. Option C overstates the risk. Failback is a standard, manageable process when executed with proper controls. Permanently abandoning the primary site is operationally and financially untenable. Study tip: On continuity questions, the answer that includes validation + procedure + rollback criteria almost always wins — those three elements signal a mature, security-conscious recovery process.

Question 10

During a ransomware incident, administrators lose access to corporate email and the online directory. Attackers also send fraudulent instructions through several compromised employee accounts. The continuity plan requires rapid notification of employees, but all messages must be clearly attributable to the crisis management team.

Which preparedness measure would MOST effectively support reliable crisis communications in this situation?

Maintain an out-of-band notification service, offline contact records, and preauthorized message procedures. (correct answer)
Publish updates through corporate email using the same directory accounts but require longer passwords.
Allow department managers to choose any available social media account and compose independent instructions.
Delay employee communications until email is restored so that all messages use the normal approved channel.

Explanation: When a ransomware attack cripples your primary communication infrastructure, the core challenge becomes trust and reach — how do you contact employees through a channel the attackers haven't compromised, and how do employees know the message is legitimate? Questions like this test your understanding of business continuity and crisis communication principles, specifically the concept of out-of-band communication. Option A is correct because it addresses all three failure points at once. An out-of-band notification service (such as an SMS alert system or a dedicated crisis hotline) operates independently of corporate email, so attackers who control that environment cannot intercept or spoof it. Offline contact records ensure the directory outage doesn't strand your ability to reach people. Preauthorized message procedures establish a clear chain of attribution — employees know in advance what legitimate crisis messages look like and who sends them, making fraudulent instructions easy to spot. Option B fails immediately because it proposes using the very channel the attackers have compromised. Longer passwords don't restore trust in a system that's already been infiltrated. Option C introduces dangerous fragmentation — independent managers composing their own messages on unverified social accounts creates exactly the attribution ambiguity the scenario is trying to avoid, and potentially amplifies attacker-controlled misinformation. Option D is perhaps the most tempting trap: it sounds cautious, but delaying communications during a fast-moving ransomware incident causes operational harm and violates the continuity plan's requirement for rapid notification. As a study tip, remember that resilient crisis communication = independence + attribution + speed. Whenever a question describes a compromised primary channel, the correct answer almost always involves a pre-planned, separate channel — never improvisation on the broken one.