Chapter 4 and 11 Flashcard

Front

True or False? Business continuity management includes business continuity planning, disaster recovery planning, crisis management, incident response management, and risk management.

Back

True

Front

True or False? A successful business impact analysis (BIA) maps the context, the critical business functions (CBFs), and the processes on which they rely.

Back

True

Front

Which data source comes first in the order of volatility when conducting a forensic investigation? Options: Logs, Files on disk, Swap and paging files, Random Access Memory (RAM)

Back

Random Access Memory (RAM)

Answer explanation

Volatile data is data that may change in the near future. Forensic

investigators should always collect the most volatile data first.

RAM has a higher volatility than information stored on disk, which

would include logs, disk files, and swap/paging files.

Front

True or False? An organization can maintain a cloud-based disaster recovery site for a fraction of the cost of a physical site.

Back

True

Front

A(n) _________ is an event that prevents a critical business function (CBF) from operating for a period greater than the maximum tolerable downtime (MTD).

Back

Disaster

Answer explanation

A disaster is an event that prevents a CBF from operating for a

period greater than the MTD. An incident is an event that results in

an actual or threatened violation of security policy. Violation is a

general term, which may or may not affect business operations. A

contingency is a provision for an unforeseen event or

circumstance, not the event itself.

Front

Which of the following should you avoid during a disaster and recovery? If a number of systems are down, provide additional guidance or support to users, Combine services that were on different hardware platforms onto common servers to speed up recovery, While running at the alternate site, continue to make backups of data and systems, Continue normal processes, such as separation of duties or spending limits

Back

Continue normal processes, such as separation of duties or spending limits

Answer explanation

It is better to suspend normal processes, such as separation of

duties or spending limits. Compensate with additional controls or

by additional auditing. The disaster recovery plan (DRP) should

give added privileges or spending authority to certain people or for

certain tasks.

Front

True or False? A business impact analysis (BIA) details the steps to recover from a disruption and restore the infrastructure necessary for normal business operations.

Back

False

Answer explanation

A disaster recovery plan (DRP) details the steps to recover from a

disruption and restore the infrastructure necessary for normal

business operations. A BIA is an analysis of the business to

determine what kinds of events could interrupt normal operation.

Front

During which step of the incident-handling process do you develop a formal communication plan and identify all key stakeholders?

Back

Preparation

Answer explanation

The first step in an incident response program is to plan how to

best respond to a variety of incidents and to build the incident

response team (IRT). Part of the preparation phase should be to

develop a formal communication plan and to identify all key

stakeholders.

Front

True or False? Examples of major disruptions include extreme weather, application failure, and criminal activity.

Back

True

Front

True or False? Any component that, if it fails, could interrupt business processing is called a single point of failure (SPOF).

Back

True