Chapter 4 and 11 Quiz

True or False? Business continuity management includes business

continuity planning, disaster recovery planning, crisis management,

incident response management, and risk management.

• True

• False

True or False? A successful business impact analysis (BIA) maps the

context, the critical business functions (CBFs), and the processes on

which they rely.

• True

• False

Which data source comes first in the order of volatility when conducting a

forensic investigation?

• Logs

• Files on disk

• Swap and paging files

• Random Access Memory (RAM)

Answer explanation

Volatile data is data that may change in the near future. Forensic

investigators should always collect the most volatile data first.

RAM has a higher volatility than information stored on disk, which

would include logs, disk files, and swap/paging files.

True or False? An organization can maintain a cloud-based disaster

recovery site for a fraction of the cost of a physical site.

• True

• False

A(n) _________ is an event that prevents a critical business function

(CBF) from operating for a period greater than the maximum tolerable

downtime (MTD).

• Incident

• Disaster

• Contingency

• Violation

Answer explanation

A disaster is an event that prevents a CBF from operating for a

period greater than the MTD. An incident is an event that results in

an actual or threatened violation of security policy. Violation is a

general term, which may or may not affect business operations. A

contingency is a provision for an unforeseen event or

circumstance, not the event itself.

Which of the following should you avoid during a disaster and recovery?

• If a number of systems are down, provide additional guidance or support to

  users

• Combine services that were on different hardware platforms onto common

  servers to speed up recovery

• While running at the alternate site, continue to make backups of data and

  systems

• Continue normal processes, such as separation of duties or spending

  limits

Answer explanation

It is better to suspend normal processes, such as separation of

duties or spending limits. Compensate with additional controls or

by additional auditing. The disaster recovery plan (DRP) should

give added privileges or spending authority to certain people or for

certain tasks.

True or False? A business impact analysis (BIA) details the steps to

recover from a disruption and restore the infrastructure necessary for

normal business operations.

• True

• False

Answer explanation

A disaster recovery plan (DRP) details the steps to recover from a

disruption and restore the infrastructure necessary for normal

business operations. A BIA is an analysis of the business to

determine what kinds of events could interrupt normal operation.

During which step of the incident-handling process do you develop a

formal communication plan and identify all key stakeholders?

• Identification

• Documentation

• Notification

• Preparation

Answer explanation

The first step in an incident response program is to plan how to

best respond to a variety of incidents and to build the incident

response team (IRT). Part of the preparation phase should be to

develop a formal communication plan and to identify all key

stakeholders.

True or False? Examples of major disruptions include extreme weather,

application failure, and criminal activity.

• True

• False

True or False? Any component that, if it fails, could interrupt business

processing is called a single point of failure (SPOF).

• True

• False