CISSP Business Continuity 3 — Questions and Answers
Question 1: Which of the following BEST describes a reciprocal agreement in business continuity planning?
- A contract with a vendor to provide hot-site facilities
- An arrangement between two organizations to host each other's operations during a disaster (Correct answer)
- An insurance policy covering business interruption losses
- A government mandate requiring critical infrastructure backup
Correct answer: An arrangement between two organizations to host each other's operations during a disaster
A reciprocal agreement is a mutual arrangement where two organizations agree to provide backup processing space for each other in case of disaster.
Question 2: During BCP development, which phase involves identifying which assets and systems are most critical to ongoing business operations?
- Plan design
- Business Impact Analysis (BIA) (Correct answer)
- Plan testing
- Plan maintenance
Correct answer: Business Impact Analysis (BIA)
The BIA phase identifies critical assets, processes, and the impact of their loss to prioritize recovery efforts.
Question 3: A financial services company replicates its database to a secondary data center 500 miles away with a 4-hour lag. Which risk does this configuration introduce?
- Exceeding the RTO if systems fail
- Losing up to 4 hours of data if the primary site fails (Correct answer)
- Violating geographic diversity requirements
- Creating a single point of failure in network routing
Correct answer: Losing up to 4 hours of data if the primary site fails
A 4-hour replication lag means up to 4 hours of transactions could be lost if the primary site fails, potentially exceeding the RPO.
Question 4: Which standard provides international guidance on Business Continuity Management Systems (BCMS)?
- ISO 27001
- ISO 22301 (Correct answer)
- NIST SP 800-34
- PCI DSS
Correct answer: ISO 22301
ISO 22301 is the international standard for Business Continuity Management Systems, providing requirements and guidelines.
Question 5: A parallel test of a DRP involves which key characteristic?
- Completely shutting down primary systems to test recovery
- Running both primary and alternate systems simultaneously (Correct answer)
- Discussing recovery steps without activating any systems
- Testing only a single department's recovery capability
Correct answer: Running both primary and alternate systems simultaneously
In a parallel test, the alternate site is activated and runs concurrently with the primary site to validate recovery without business interruption.
Question 6: Which element should be reviewed and updated FIRST when a significant organizational change occurs, such as a merger or new product launch?
- Disaster recovery runbooks
- Business Impact Analysis (BIA) (Correct answer)
- Call tree contact lists
- Insurance policies
Correct answer: Business Impact Analysis (BIA)
A new or changed business function requires an updated BIA to re-evaluate criticality, MTD, RTO, and RPO for the changed organization.
Question 7: What distinguishes a Business Continuity Plan (BCP) from a Disaster Recovery Plan (DRP)?
- The BCP focuses on IT system restoration while the DRP addresses entire business operations
- The BCP addresses maintaining business operations during a disruption; the DRP focuses on restoring IT systems afterward (Correct answer)
- The BCP applies only to natural disasters while the DRP covers cyberattacks
- The BCP is created by IT and the DRP is created by executive management
Correct answer: The BCP addresses maintaining business operations during a disruption; the DRP focuses on restoring IT systems afterward
The BCP is broader, covering how the business continues to operate during a disruption, while the DRP specifically addresses IT and infrastructure restoration.
CISSP Business Continuity 3
Which of the following BEST describes a reciprocal agreement in business continuity planning?