Business Continuity and Disaster Recovery Flashcards
(41 cards)
You are concerned about the risk that an avalanche poses to your $3 million shipping facility. Based on expert opinion, you determine that there is a 5 percent chance that an avalanche will occur each year. Experts advise you that an avalanche would completely destroy your building and require you to rebuild on the same land. Ninety percent of the $3 million value of the facility is attributed to the building and 10 percent is attributed to the land itself. What is the single loss expectancy of your shipping facility to avalanches? A) $3,000,000 B) $2,700,000 C) $270,000 D) $135,000
$2,700,000
The SLE is the product of the AV and the EF. From the scenario, you know that the AV is $3,000,000 and the EF is 90 percent, based on that the same land can be used to rebuild the facility. This yields an SLE of $2,700,000.
What unit of measurement should be used to assign quantitative values to assets in the priority identification phase of the business impact assessment? A) Monetary B) Utility C) Importance D) Time
Monetary
The quantitative portion of the priority identification should assign asset values in monetary units.
In which one of the following database recovery techniques is an exact, up-to-date copy of the database maintained at an alternative location? A) Transaction logging B) Remote journaling C) Electronic vaulting D) Remote mirroring
Remote mirroring
When you use remote mirroring, an exact copy of the database is maintained at an alternative location. You keep the remote copy up-to-date by executing all transactions on both the primary and remote site at the same time.
What kind of recovery facility enables an organization to resume operations as quickly as possible, if not immediately, upon failure of the primary facility? A) Hot site B) Warm site C) Cold site D) All of these are correct
Hot site
Hot sites provide backup facilities maintained in constant working order and fully capable of taking over business operations. Warm sites consist of preconfigured hardware and software to run the business, neither of which possesses the vital business information. Cold sites are simply facilities designed with power and environmental support systems but no configured hardware, software, or services. Disaster recovery services can facilitate and implement any of these sites on behalf of a company.
Which one of the following concerns is not suitable for quantitative measurement during the business impact assessment? A) Loss of a plant B) Damage to a vehicle C) Negative publicity D) Power outage
Negative publicity
It is very difficult to put a dollar figure on the business lost because of negative publicity. Therefore, this type of concern is better evaluated through a qualitative analysis.
Which one of the following disaster types is not usually covered by standard business or homeowner's insurance? A) Earthquake B) Flood C) Fire D) Theft
Flood
Most general business insurance and homeowner’s insurance policies do not provide any protection against the risk of flooding or flash floods. If floods pose a risk to your organization, you should consider purchasing supplemental flood insurance under FEMA’s National Flood Insurance Program.
Which of the following represent natural events that can pose a threat or risk to an organization? A) Earthquake B) Flood C) Tornado D) All of these are correct
All of these are correct
Natural events that can threaten organizations include earthquakes, floods, hurricanes, tornados, wildfires, and other acts of nature as well. Thus all these options are correct because they are natural and not man made.
Which of the following statements about business continuity planning and disaster recovery planning is incorrect?
A) Business continuity planning is focused on keeping business functions uninterrupted when a disaster strikes.
B) Organizations can choose whether to develop business continuity planning or disaster recovery planning plans.
C) Business continuity planning picks up where disaster recovery planning leaves off.
D) Disaster recovery planning guides an organization through recovery of normal operations at the primary facility.
Business continuity planning picks up where disaster recovery planning leaves off.
The opposite of this statement is true-disaster recovery planning picks up where business continuity planning leaves off. The other three statements are all accurate reflections of the role of business continuity planning and disaster recovery planning.
What is the formula used to compute the ALE? A) ALE = AV * EF * ARO B) ALE = ARO * EF C) ALE = AV * ARO D) ALE = EF * ARO
ALE = AV * EF * ARO
The annualized loss expectancy (ALE) is computed as the product of the asset value (AV) times the exposure factor (EF) times the annualized rate of occurrence (ARO). This is the longer form of the formula ALE = SLE * ARO. The other formulas displayed here do not accurately reflect this calculation.
What disaster recovery principle best protects your organization against hardware failure? A) Consistency B) Efficiency C) Redundancy D) Primacy
Redundancy
Redundant systems/components provide protection against the failure of one particular piece of hardware.
Which resource should you protect first when designing continuity plan provisions and processes? A) Physical plant B) Infrastructure C) Financial D) People
People
The safety of human life must always be the paramount concern in business continuity planning. Be sure that your plan reflects this priority, especially in the written documentation that is disseminated to your organization’s employees!
What type of document will help public relations specialists and other individuals who need a high-level summary of disaster recovery efforts while they are underway? A) Executive summary B) Technical guides C) Department-specific plans D) Checklists
Executive summary
The executive summary provides a high-level view of the entire organization’s disaster recovery efforts. This document is useful for the managers and leaders of the firm as well as public relations personnel who need a nontechnical perspective on this complex effort.
What combination of backup strategies provides the fastest backup creation time?
A) Full backups and differential backups
B) Partial backups and incremental backups
C) Full backups and incremental backups
D) Incremental backups and differential backups
Full backups and incremental backups
Any backup strategy must include full backups at some point in the process. Incremental backups are created faster than differential backups because of the number of files it is necessary to back up each time.
What type of disaster recovery plan test fully evaluates operations at the backup facility but does not shift primary operations responsibility from the main site? A) Structured walk-through B) Parallel test C) Full-interruption test D) Simulation test
Parallel test
Parallel tests involve moving personnel to the recovery site and gearing up operations, but responsibility for conducting day-to-day operations of the business remains at the primary operations center.
What type of backup involves always storing copies of all files modified since the most recent full backup? A) Differential backups B) Partial backup C) Incremental backups D) Database backup
Differential backups
Differential backups involve always storing copies of all files modified since the most recent full backup regardless of any incremental or differential backups created during the intervening time period.
What is the typical time estimate to activate a warm site from the time a disaster is declared? A) 1 hour B) 6 hours C) 12 hours D) 24 hours
12 hours
Warm sites typically take about 12 hours to activate from the time a disaster is declared. This is compared to the relatively instantaneous activation of a hot site and the lengthy time (at least a week) required to bring a cold site to operational status.
What combination of backup strategies provides the fastest backup restoration time?
A) Full backups and differential backups
B) Partial backups and incremental backups
C) Full backups and incremental backups
D) Incremental backups and differential backups
Full backups and differential backups
Any backup strategy must include full backups at some point in the process. If a combination of full and differential backups is used, a maximum of two backups must be restored. If a combination of full and incremental backups is chosen, the number of required restorations may be unlimited.
Once the BCP team is selected, what should be the first item placed on the team's agenda? A) Business impact assessment B) Business organization analysis C) Resource requirements analysis D) Legal and regulatory assessment
Business organization analysis
The first task of the BCP team should be the review and validation of the business organization analysis initially performed by those individuals responsible for spearheading the BCP effort. This ensures that the initial effort, undertaken by a small group of individuals, reflects the beliefs of the entire BCP team.
What business continuity planning technique can help you prepare the business unit prioritization task of disaster recovery planning? A) Vulnerability analysis B) Business impact assessment C) Risk management D) Continuity planning
Business impact assessment
During the business impact assessment phase, you must identify the business priorities of your organization to assist with the allocation of BCP resources. You can use this same information to drive the DRP business unit prioritization.
You are concerned about the risk that a hurricane poses to your corporate headquarters in South Florida. The building itself is valued at $15 million. After consulting with the National Weather Service, you determine that there is a 10 percent likelihood that a hurricane will strike over the course of a year. You hired a team of architects and engineers who determined that the average hurricane would destroy approximately 50 percent of the building. What is the annualized loss expectancy (ALE)? A) $750,000 B) $1.5 million C) $7.5 million D) $15 million
$750,000
This problem requires you to compute the ALE, which is the product of the SLE and ARO. From the scenario, you know that the ARO is 0.10 (or 10 percent). From the scenario presented, you know that the SLE is $7.5 million. This yields an SLE of $750,000.
Which one of the following is an example of a man-made disaster? A) Tsunami B) Earthquake C) Power outage D) Lightning strike
Power outage
A power outage is an example of a man-made disaster. The other events listed- tsunamis, earthquakes, and lightning strikes-are all naturally occurring events.
Which one of the following items is a characteristic of hot sites but not a characteristic of warm sites? A) Communications circuits B) Workstations C) Servers D) Current data
Current data
Warm sites and hot sites both contain workstations, servers, and the communications circuits necessary to achieve operational status. The main difference between the two alternatives is the fact that hot sites contain near-real-time copies of the operational data and warm sites require the restoration of data from backup.
Lighter Than Air Industries expects that it would lose $10 million if a tornado struck its aircraft operations facility. It expects that a tornado might strike the facility once every 100 years. What is the single loss expectancy for this scenario? A) 0.01 B) $10,000,000 C) $100,000 D) 0.10
$10,000,000
The single loss expectancy (SLE) is the amount of damage that would be caused by a single occurrence of the risk. In this case, the SLE is $10 million, the expected damage from one tornado. The fact that a tornado occurs only once every 100 years is not reflected in the SLE but would be reflected in the annualized loss expectancy (ALE).
What BIA metric can be used to express the longest time a business function can be unavailable without causing irreparable harm to the organization? A) SLE B) EF C) MTD D) ARO
MTD
The maximum tolerable downtime (MTD) represents the longest period a business function can be unavailable before causing irreparable harm to the business. This figure is useful when determining the level of business continuity resources to assign to a particular function.
