CISSP Business Continuity 2 — Questions and Answers
Question 1: Which metric defines the maximum tolerable period that a business process can be offline before causing unacceptable consequences?
- Recovery Time Objective (RTO)
- Maximum Tolerable Downtime (MTD) (Correct answer)
- Recovery Point Objective (RPO)
- Mean Time to Repair (MTTR)
Correct answer: Maximum Tolerable Downtime (MTD)
MTD (also called Maximum Tolerable Outage) is the longest a process can be unavailable before the organization suffers irreversible harm.
Question 2: A BCP team identifies that losing two hours of financial transaction data is acceptable. Which metric does this represent?
- RTO
- MTD
- RPO (Correct answer)
- MTPD
Correct answer: RPO
Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss measured in time.
Question 3: Which BCP document lists the specific steps staff must follow to restore a critical system after a disaster?
- Business Impact Analysis
- Disaster Recovery Plan (Correct answer)
- Crisis Communication Plan
- Risk Register
Correct answer: Disaster Recovery Plan
The Disaster Recovery Plan (DRP) contains detailed procedural steps for restoring IT systems and infrastructure.
Question 4: During a BIA, which factor is used to rank the criticality of business functions?
- Number of employees assigned to the function
- Financial and operational impact of disruption over time (Correct answer)
- Age of the hardware supporting the function
- Number of regulatory requirements applicable
Correct answer: Financial and operational impact of disruption over time
The BIA ranks functions by the financial, operational, and reputational impact that results from their disruption.
Question 5: An organization's alternate processing site has identical hardware and software in a fully operational state, synchronized in real time. What type of site is this?
- Warm site
- Cold site
- Hot site (Correct answer)
- Mobile site
Correct answer: Hot site
A hot site is a fully operational duplicate facility that can take over processing with minimal or no delay.
Question 6: Which testing method validates BCP procedures with the LEAST disruption to normal operations?
- Full interruption test
- Parallel test
- Tabletop exercise (Correct answer)
- Simulation test
Correct answer: Tabletop exercise
A tabletop exercise involves walking through BCP scenarios in a discussion format without activating any systems or personnel.
Question 7: What is the PRIMARY purpose of a call tree in a BCP?
- To document network topology for recovery teams
- To ensure rapid and structured notification of key personnel (Correct answer)
- To map application dependencies during failover
- To record vendor contact information for procurement
Correct answer: To ensure rapid and structured notification of key personnel
A call tree is a structured communication cascade that ensures key personnel are notified quickly during an incident.
CISSP Business Continuity 2
Which metric defines the maximum tolerable period that a business process can be offline before causing unacceptable consequences?