11/12/2016 [Link]/print?

xmlid=9781118105948%2Ftraditional_questions_answers0024

Username:AdityaMishraBook:CISSPPractice:2,250Questions,Answers,[Link]
reproducedortransmittedinanyformbyanymeanswithoutthepriorwrittenpermissionforreprintsandexcerptsfromthepublisherofthebookorchapter.
[Link](see17USC107)orthatotherwiseviolatestheseTermsofServiceis
[Link].

TRADITIONALQUESTIONS,ANSWERS,ANDEXPLANATIONS

[Link](IT)contingencysolutionforserversminimizestherecoverytimewindow?

[Link]

[Link]

[Link]

[Link]

[Link],recoverywindowsareminimizedbecausedataiswrittentotwodifferentdiskstoensurethattwovalidcopiesofthedataarealways
[Link](themainserver)andthereplicatingserver(thebackupserver).Electronicvaultingandremotejournalingare
similartechnologiesthatprovideadditionaldatabackupcapabilities,[Link]
increasesserverandapplicationsystemavailability.

[Link]?

[Link]

[Link]

[Link]

[Link]

[Link](NAS)orstorageareanetwork(SAN)providehighavailabilitybecauseitcombinesmultiplephysicalstoragedevices
intoalogical,[Link]
vaultingprovideavailabilitylevelsbetweenhighandlow.

[Link],whichofthefollowingITplatformsrequiresvendorservicelevelagreements?

[Link]

[Link]

[Link]

[Link]

3.d. A widearea network (WAN) is a data communications network that consists of two or more localarea networks (LANs) that are dispersed over a wide
[Link],usuallyprovidedbyapubliccarrier,[Link](SLAs)can
[Link]
(NSP) or the Internet service provider (ISP) to guarantee the desired network availability and establish tariffs if the vendor's network is unavailable. Desktop
computers,servers,anddistributedsystemarenotascomplicatedasWANsrequiringSLAs.

[Link](BCP)anddisasterrecoveryplanning(DRP),whichofthefollowingcontingencysolutionsfor
wideareanetworks(WANs)increasesvulnerabilitytohackers?

[Link]

[Link]

[Link]

[Link]

[Link]'[Link],multipleInternetconnectionsprovideredundancy,
meaningthatifoneconnectionweretofail,[Link],thereisatradeoffbetweensecurityandavailability.
[Link]
providers(NSPs)andtheInternetserviceproviders(ISPs)[Link]
suchasrouters,switches,andfirewallscancreatehighavailability.

[Link],whichofthefollowingITplatformstypicallyprovidesomeinherentlevelofredundancy?

[Link]

[Link]

[Link] 1/25
11/12/2016 [Link]/print?xmlid=9781118105948%2Ftraditional_questions_answers0024
[Link]

[Link]

[Link],andtheyrelyextensivelyon
[Link]'sheadquarterslocationandisreplicatedtothelocalsites,thedistributedsystemprovidessome
[Link].

[Link](RTOs)rangingfromminutestoseveralhours?

[Link]

[Link]

[Link]

[Link]

[Link]
synchronousmirroring,therecoverytimeobjectives(RTOs)canbeminutestoseveralhours(forshortertimeperiods),andhenceshouldbeusedforapplicationsthat
[Link],theRTOcanrangefromseveralhourstoaday(forlongertimeperiods),dependingonthetimethatis
[Link].

[Link],missioncritical
[Link]'sgoalistoimprovethereliabilityand
[Link]
[Link]
[Link]
[Link]
theavailabilitygoalwillensuretimelyandreliableaccesstoanduseofsystemrelateddataandinformation,asitisanindicatorofquantity
ofservice.

Whichofthefollowingsystemshasthehighestavailabilityinayearexpressedinpercentagesandroundedup?

a.System1

b.System2

c.System3

d.System4

[Link],thelowerthedowntimeforasystem,thehighertheavailabilityofthatsystem,and
higherthereliabilityofthatsystem,[Link],thisquestiondoesnotrequireanycalculationstoperformbecauseonecanfindoutthecorrectanswerjust
bylookingatthedowntimeanduptimedatagiveninthatthelowerthedowntimehours,thehighertheuptimehours,andthehighertheavailabilityofthesystem,
andviceversa.

CalculationsforSystem1areshownbelowandcalculationsforothersystemsfollowtheSystem1calculations.
AvailabilityforSystem1=[Uptime/(Uptime+Downtime)]100=[(8,560/8,760)]100=97.7%
ReliabilityforSystem1=[1(Downtime/Downtime+Uptime)]100=[1(200/8,760)]100=97.7%
Check:ReliabilityforSystem1=100(100Availabilitypercent)=100(10097.7)=97.7%
Thisgoestosaythattheavailabilityandreliabilitygoalsareintrinsicallyrelatedtoeachother,wheretheformerisacomponentofthelatter.

[Link] 2/25
11/12/2016 [Link]/print?xmlid=9781118105948%2Ftraditional_questions_answers0024
[Link],redundantarrayofindependentdisk(RAID)doesnotdowhichofthefollowing?

[Link]

[Link]

[Link]

[Link]

[Link](RAID)doesnotprovidepowerredundancyandshouldbeacquiredthroughanuninterruptiblepowersupplysystem.
However,RAIDprovidestheotherthreechoices.

[Link](RAID)technologydoesnotusewhichofthefollowing?

[Link]

[Link]

[Link]

[Link]

[Link](RAID)technologyusesthreedataredundancytechniquessuchasmirroring,parity,andstriping,notelectronicvaulting.
Electronicvaultingislocatedoffsite,whereasRAIDisplacedatlocalserverswheretheformermayusethelatter.

[Link],theboardofdirectorsofanorganizationisnotrequiredtofollowwhichofthefollowing?

[Link]

[Link]

[Link]

[Link]

[Link]
[Link],thedirectorsneedtofollowtheotherthreedutiesofduecare,loyalty,andobedience.

11. Whichofthefollowingtasksisnotapartofbusinesscontinuityplan(BCP)?

[Link]

[Link]

[Link]

[Link]

[Link](BCP)anddisasterrecoveryplanning(DRP)[Link],disaster
recoveryprocedurescomeintoplayonlyduringdisaster,whichisapartofDRP.

[Link](DRP)?

[Link]

[Link]

[Link]

[Link]

[Link](BCP)anddisasterrecoveryplanning(DRP)[Link],selectingan
alternativeprocessingsiteshouldbeplannedoutpriortoadisaster,[Link]
withdataprocessingandBCPreferstoactionsthatkeepthebusinessrunningintheeventofadisruption,evenifitiswithpencilandpaper.

[Link],criticalmeasurementsinbusinessimpactanalysis(BIA)includewhichofthefollowing?

[Link]

[Link]

[Link]

[Link]

[Link] 3/25
11/12/2016 [Link]/print?xmlid=9781118105948%2Ftraditional_questions_answers0024
[Link](BIA)includerecoverytimeobjectives(RTOs)andrecoverypointobjectives(RPOs).Usually,systems
areclassifiedasgeneralsupportsystems(forexample,networks,servers,computers,gateways,andprograms)andmajorapplicationsystems(forexample,billing,
payroll,inventory,andpersonnelsystem).Uninterruptiblepowersupply(UPS)systemisanauxiliarysystemsupportinggeneralsystemsandapplicationsystems.
Regardlessofthenatureandtypeofasystem,theyallneedtofulfilltheRTOsandRPOstodeterminetheirimpactonbusinessoperations.

[Link],whichofthefollowingestablishesaninformationsystem'srecoverytimeobjective(RTO)?

[Link]

[Link]

[Link]

[Link]

[Link](MAO)andthecosttorecoverestablishesaninformationsystem'srecoverytimeobjective(RTO).
[Link](MTD).Theotherthreechoicesare
incorrectbecausetheydonotdealwithtimeandcostdimensionstogether.

[Link],whichofthefollowingdeterminestherecoverycostbalancing?

[Link]

[Link]

[Link]

[Link]

[Link]
[Link],whichindicateshowlonganorganizationcanaffordtoallowthesystemtobedisruptedorunavailable.
Theotherthreechoicesareincorrectbecausetheydonotdealwiththerecoverycostbalancingprinciple.

[Link],whichofthefollowingactionsareperformedwhenmaliciousattackscompromisetheconfidentialityor
integrityofaninformationsystem?

[Link]

[Link]

[Link]

[Link]

a.1and2

b.2and3

c.3and4

d.1,2,3,and4

16. d. The actions to perform during malicious attacks compromise the confidentiality or integrity of the information system include graceful degradation,
informationsystemshutdown,fallbacktoamanualmode,alternativeinformationflows,oroperatinginamodethatisreservedsolelyforwhenthesystemisunder
attack.

[Link],whichofthefollowingaremechanismssupportingtransactionrecovery?

[Link]

[Link]

[Link]

[Link]

a.1only

b.1and2

c.3and4

d.1,2,3,and4

[Link]
packets. A compiler is software used to translate a computer program written in a highlevel programming language (source code) into a machine language for
[Link].

[Link] 4/25
11/12/2016 [Link]/print?xmlid=9781118105948%2Ftraditional_questions_answers0024
[Link],whichofthefollowingissusceptibletopotentialaccessibilityproblemsintheeventofanareawide
disaster?

[Link]

[Link]

[Link]

[Link]

a.1and2

b.2and3

c.3only

d.1and4

18.a. Both alternative storage site and alternative processing site are susceptible to potential accessibility problems in the event of an areawide disruption or
disaster. Explicit mitigation actions are needed to handle this problem. Telecommunication services (ISPs and network service providers) and remote redundant
secondarysystemsarelocatedfarawayfromthelocalarea,hencenotsusceptibletopotentialaccessibilityproblems.

[Link]?

[Link]

[Link]

[Link]

[Link]

[Link]
successfulcompletionofindividualtasksandthatthecorebusinessprocessownersareresponsibleandaccountableformeetingthemilestonesforthedevelopment
andtestingofcontingencyplansfortheircorebusinessprocesses.

[Link],strategicreasonsforseparatingthealternativestoragesitefromtheprimarystoragesiteinclude
ensuring:

[Link].

[Link].

[Link].

[Link].

a.1and2

b.1,2,and3

c.1,2,and4

d.1,2,3,and4

[Link](i.e.,alternativestoragesiteandprimarystoragesite)arenotsusceptibletothesamehazards,arenotcolocatedinthe
samearea,havethesamerecoverytimeobjectives(RTOs),andhavethesamerecoverypointobjectives(RPOs).

[Link],ifMAOismaximumallowableoutage,BIAisbusinessimpactanalysis,RTOisrecoverytimeobjective,MTBFis
meantimebetweenfailures,RPOisrecoverypointobjective,MTTRismeantimetorepair,andUPSisuninterruptiblepowersupply,which
oneofthefollowingisrelatedtoandcompatiblewitheachotherwithinthesamechoice?

[Link],BIA,RTO,andMTBF

[Link],RTO,RPO,andMAO

[Link],MTTR,RPO,andUPS

[Link],MTBF,MTTR,andUPS

21.b. A business impact analysis (BIA) is conducted by identifying a system's critical resources. Two critical resource measures in BIA include recovery time
objective(RTO)andrecoverypointobjective(RPO).TheimpactinBIAisexpressedintermsofmaximumallowableoutage(MAO).Hence,BIA,RTO,RPO,and
[Link],MTTRismeantimetorepair,andUPSisuninterruptiblepowersupply,and
theyhavenorelationtoBIA,RTO,RPO,andMAObecauseMAOdealswithmaximumtime,whereasMTTFandMTTRdealswithmeantime(i.e.,averagetime).

[Link],systemlevelinformationbackupsdonotrequirewhichofthefollowingtoprotecttheirintegritywhilein
storage?

[Link] 5/25
11/12/2016 [Link]/print?xmlid=9781118105948%2Ftraditional_questions_answers0024
[Link]

[Link]

[Link]

[Link]

[Link],applicationsoftware,[Link]
[Link],encryption,andcryptographichashesto
protecttheirintegrity.

[Link]?

[Link]

[Link]

[Link]

[Link]

[Link]
areoperationalcontrols,whereastheitemsmentionedintheotherchoicescomeundermanagementcontrolsandanalyticalinnature.

[Link]?

[Link].

[Link],anelectronicvaultcanmakethedifferencebetweenanorganization'ssurvivalandfailure.

[Link].

[Link].

[Link],[Link]
[Link],[Link]
electronicvaultingeliminatestapes,whichareahindrancetoautomatedoperations,electronicvaultingsupportsautomation.

[Link],informationsystembackupsrequirewhichofthefollowing?

[Link].

[Link].

[Link].

[Link].

a.1and2

b.1,2,and3

c.1,2,and4

d.1,2,3,and4

[Link],andthesamebackupcanbemaintainedataredundantsecondarysystem,not
[Link](RTOs)andsamerecoverypointobjectives(RPOs).
Thisarrangementcanbeactivatedwithoutlossofinformationordisruptiontotheoperation.

[Link]?

[Link]

[Link]

[Link]

[Link]

[Link]

b.1and2

c.1,2,and3

d.1,2,3,and4

[Link] 6/25
11/12/2016 [Link]/print?xmlid=9781118105948%2Ftraditional_questions_answers0024
[Link](RTO)[Link]
shouldaddressdisruptionimpactsandallowableoutagetimesidentifiedinthebusinessimpactanalysis(BIA).Thechosenstrategymustalsobecoordinatedwith
[Link],includingcost,allowableoutagetimes,
security,andintegrationintoorganizationlevelcontingencyplans.

[Link]?

[Link]

[Link]

[Link]

[Link]

[Link],[Link]
[Link],[Link]
[Link],costofnotmeetinglegaland
regulatoryrequirements,costofnotmeetingcontractualandfinancialobligations,[Link]
continuity of business operations, ability to make sales and profits, providing gainful employment, and satisfying internal and external customers and other
stakeholders.
Therecoverystrategymustmeetcriticalityandavailabilityofdataandsystemsandrecoverytimeobjective(RTO)requirementswhileremainingwithinthecostand
benefitguidelines.

[Link],whichofthefollowingdoesnotpreventpotentialdataloss?

[Link]

[Link]

[Link]

[Link]

[Link],dataaddedtoormodifiedontheserversincethepreviousbackupcouldbe
lost during a disruption or disaster. To avoid this potential data loss, a backup strategy may need to be complemented by redundancy solutions, such as disk
mirroring,redundantarrayofindependentdisk(RAID),andloadbalancing.

[Link](RTO)forapayrollsystemidentifiedinabusinessimpactanalysis(BIA)
document?

[Link].

b.LANdisruptionfor8hoursmaycreateadelayintimesheetprocessing.

c.TheLANservermustberecoveredwithin8hourstoavoidadelayintimesheetprocessing.

[Link].

29.c.TheLANservermustberecoveredwithin8hourstoavoidadelayintimesheetprocessingisanexampleofBIA'srecoverytimeobjective(RTO).Timeand
attendancereportingmayrequiretheuseofaLANserverandotherresourcesisanexampleofBIA'scriticalresource.LANdisruptionfor8hoursmaycreateadelay
intimesheetprocessingisanexampleofBIA'[Link]
anexampleofBIA'srecoverypointobjective(RPO).

[Link](BIA)asapartoftheITcontingency
planningprocess?

[Link]'scomponents

[Link]'sinterdependencies

[Link]'scriticalresources

[Link]'sdowntimeimpacts

a.1and2

b.2and3

c.3and4

d.1,2,3,and4

[Link](BIA)isacriticalsteptounderstandingtheinformationsystemcomponents,interdependencies,andpotentialdowntimeimpact.
[Link]'scritical
[Link]
[Link],system'scriticalresourcesandsystem'sdowntimeimpactsarecloselyrelatedtoeachotherthantheotheritems.

[Link] 7/25
11/12/2016 [Link]/print?xmlid=9781118105948%2Ftraditional_questions_answers0024
[Link](BCP)needperiodicauditstoensuretheaccuracy,currency,completeness,applicability,andusefulnessofsuch
[Link]?

[Link]

[Link]

[Link]

[Link]

31.b. Selfassessments are proactive exercises and are a prerequisite to other types of audits. Selfassessments are in the form of questionnaires and usually a
company'semployees(forexample,supervisorsormangers)conducttheseselfassessmentstocollectanswersfromfunctionalmanagementandITmanagementon
[Link],theycanbeeyeopeningexercisesbecausetheirresultsmaynotbethe
[Link]
canbeimproved.
Inaddition,selfassessmentsmakeanorganizationreadyandpreparedfortheotherauditssuchasinternalauditsbycorporateinternalauditors,externalauditsby
publicaccountingfirms,andthirdpartyauditsbyregulatorycomplianceauditors,insuranceindustryauditors,[Link],overallauditcostscanbereducedif
theseauditorscanrelyontheresultsofselfassessments,[Link]
becauseauditorsdonotneedtorepeattheseassessmentswithfunctionalandITmanagement,thussavingtheiraudittime,resultinginreductioninauditcosts.
However,[Link]
recovery standards, reviews recovery problems and solutions, verifies the appropriateness of recovery test exercises, and reviews the criteria for updating and
maintainingaBCP.
Here,themajorpointisthatselfassessmentsshouldbeperformedinanindependentandobjectivemannerwithoutthecompanymanagement'sundueinfluenceon
[Link]
ensurethatrightquestionsareaskedandrightareasareaddressed.

[Link]'svitalrecordsprogrammustmeetwhichofthefollowing?

[Link],audit,andregulatoryrequirements

[Link]

[Link]

[Link]

a.1only

b.1and2

c.1,3,and4

d.1,2,3,and4

[Link]
the requirements of functional departments of a company (for example, accounting, marketing, production, and human resources) to run daytoday business
operations(currentandfuture).Inaddition,companiesthatareheavilyregulated(forexample,bankingandinsurance)requirecertainvitalrecordstoberetainedfora
specified amount of time. Also, internal auditors, external auditors, and thirdparty auditors (for example, regulatory auditors and banking/insurance industry
auditors)[Link],theseauditorsreviewcompliancewiththerecordretentionrequirements
[Link],[Link],vitalrecordsareso
vitalforthelongrunsuccessofacompany.
First,acompanymanagementwiththecoordinationofcorporatelegalcounselmusttakeaninventoryofallrecordsusedinacompany,classifywhatrecordsarevital,
andidentifywhatvitalrecordssupportthecontinuityofbusinessoperations,legalevidence,disasterrecoverywork,andauditworkknowingthatnotallrecordsand
documentsthatacompanyhandleseverydayarevitalrecords.
[Link]
[Link],asystematicmethodisneededtopreserveandstorethesevitalrecords
onsiteandoffsitewithrotationproceduresbetweentheonsiteandoffsitelocations.
Corporatelegalcounselplaysanimportantroleindefiningretentionrequirementsforbothbusiness(common)[Link]
similarroleinbackingup,archiving,[Link]
isavailableandthatoutdatedbackupcopiesaredeletedordestroyedinatimelymanner.
Examplesofvitalrecordsfollow:

Legalrecords:Generalcontractsexecutiveemploymentcontractsbankloandocumentsbusinessagreementswiththirdparties,partners,
andjointventuresandregulatorycomplianceformsandreports.

Accounting/financerecords:Payroll,accountspayable,andaccountsreceivablerecordscustomerinvoicestaxrecordsandyearly
financialstatements.

Marketingrecords:Marketingplanssalescontractswithcustomersanddistributorscustomersalesordersandproductshipment
documents.

Humanresourcesrecords:Employmentapplicationandtestscores,andemployeeperformanceappraisalforms.

[Link]?

[Link] 8/25
11/12/2016 [Link]/print?xmlid=9781118105948%2Ftraditional_questions_answers0024
[Link]

[Link]

[Link]

[Link]

a.1and2

b.2and3

c.3and4

d.1,2,3,and4

[Link](forexample,firewallsandWebservers)throughtheirbusinesscontinuityplanningeffortsortheirservicelevel
agreements(SLAs),[Link]
(SOPs)areadelineationofthespecificprocesses,techniques,checklists,[Link]
[Link],acceptableusepolicies,orstandard
securitypractices.

[Link]'srecoverytimeobjective(RTO)considerswhichofthefollowing?

[Link]

[Link]

[Link]

[Link]

a.1and3

b.2and4

c.3and4

d.1,2,3,and4

[Link](MAO)foraresourceandthecosttorecoverthatresourceestablishestheinformationsystem's
recoverytimeobjective(RTO).Memorandumofagreementisanothernamefordevelopingaservicelevelagreement(SLA).

[Link]?

[Link]

[Link]

[Link]

[Link]

[Link]
[Link]
resources,staffroles,procedures,andtimetablesneededforitsimplementation.

[Link]?

[Link]

[Link]

[Link]

[Link]

[Link]
[Link],
costs,andbenefitsbecausetheformerdrivesthelatter.

[Link]?

[Link]

[Link]

[Link]

[Link] 9/25
11/12/2016 [Link]/print?xmlid=9781118105948%2Ftraditional_questions_answers0024
[Link]

[Link],whichcollectivelysupportanorganizationalcorebusinessareaor
function, interoperate as intended in an operational environment. Generally, endtoend testing is conducted when one major system in the endtoend chain is
modifiedorreplaced,[Link]
varydependingonagivenbusinessarea'ssystemdependencies(internalandexternal)andthecriticalitytothemissionoftheorganization.
Fullscale testing is costly and disruptive, whereas endtoend testing is least costly. Pilot testing is testing one system or one department before testing other
[Link].

[Link]
involvedinthecontingencyplanningprocess?

[Link]

[Link]

[Link]

[Link]

a.1,2,3,and4

b.1,3,2,and4

c.2,1,4,and3

d.2,4,1,and3

[Link]'s
critical functions operating in the event of disruptions, both large and small. This broader perspective on contingency planning is based on the distribution of
[Link]:

Identifythemissionorbusinessorcriticalfunctions.

Identifytheresourcesthatsupportthecriticalfunctions.

Anticipatepotentialcontingenciesordisasters.

Selectcontingencyplanningstrategies.

[Link]?

[Link]

[Link]

[Link]

[Link]

[Link],[Link]
help estimate the cost of options to decide an optimal strategy. Whether the strategy is onsite or offsite, a contingency planning strategy normally consists of
emergencyresponse,recovery,resumption,andimplementation.
Inemergencyresponse,[Link],thestepsthatwillbetakentocontinue
[Link],[Link]
[Link],[Link]
implementation,itisnecessarytomakeappropriatepreparations,documenttheprocedures,[Link]
thesamerelationshipasrecoveryandresumptiondoes.

[Link]:

[Link]

[Link]

[Link]

[Link]

[Link](LAN)becausethescopeofaLANislimitedtolocalareaonlysuchasabuildingorgroupof
[Link]:incidentresponse,
backupoperations,andrecovery.
[Link]
incidentsbutalsotheresourcestoalertandinformtheusersifnecessary.
BackupoperationplansarepreparedtoensurethatessentialtaskscanbecompletedsubsequenttodisruptionoftheLANenvironmentandcancontinueuntilthe
[Link],[Link]

[Link] 10/25
11/12/2016 [Link]/print?xmlid=9781118105948%2Ftraditional_questions_answers0024
[Link]
[Link].

[Link](DRP)frommosttoleastimportant:

[Link]'sfinancialimpactontheorganization.

[Link]'sproperty,equipment,anddata.

[Link].

[Link]'semployeesandthegeneralpublic.

a.1,2,3,and4

b.3,2,1,and4

c.4,1,3,and2

d.4,2,1,and3

[Link]
disaster'[Link]
betoreducephysicaldamagetoproperty,equipment,anddata.

[Link](DRP)frommosttoleastimportant:

[Link].

[Link].

[Link]'soperations.

[Link]'sassets.

a.1,2,3,and4

b.3,2,1,and4

c.3,4,2,and1

d.4,2,3,and1

[Link],increasedsecurity,
[Link]
selfinsurance.

[Link]?

[Link]

[Link]

[Link]

[Link]

[Link],[Link],disasterrecovery
[Link]
(ALE),whichiscalculatedfromthefrequencyofoccurrenceofapossiblelossmultipliedbytheexpecteddollarlossperoccurrence.

[Link]?

[Link]

[Link]

[Link]

[Link]

44.a. An application system priority analysis should be performed to determine the business criticality for each computer application. A priority code or time
[Link]
[Link]
developingarecoveryschedule.

[Link]
planning?

[Link] 11/25
11/12/2016 [Link]/print?xmlid=9781118105948%2Ftraditional_questions_answers0024
[Link]

[Link]

[Link]

[Link]

45.d. Usually, telephone service is taken for granted by the recovery team members that could negatively affect Voice over Internet Protocol (VoIP) services.
Consequently,[Link],[Link]
familiarityandvendorpresence.

[Link]'s
management?

[Link]

[Link]

[Link]

[Link]

[Link]
commitment from management. Preparedness is incorrect because it is a readiness to respond to undesirable events. It ensures effective response and minimizes
[Link]
bothshortandlongtermrestorationofvitalsystemstonormaloperations.

[Link]?

[Link]

[Link]

[Link]

[Link]

[Link],thebestinsuranceistheonecommensuratewiththemostcommontypesofriskstowhichacompanyisexposed.
[Link],lightning,[Link]
[Link].

[Link]'sperformanceandavailability?

[Link]

[Link]

[Link]

[Link]

48.c. Load balancing systems monitor each server to determine the best path to route traffic to increase performance and availability so that one server is not
[Link],withbackupsmadeto
[Link].

[Link]?

[Link]

[Link]'scapabilities

[Link]

[Link]

49.d. According to insurance industry estimates, every dollar of insured loss is accompanied by three dollars of uninsured economic loss. This suggests that
companiesareinsuredonlyforonethirdofthepotentialconsequencesofadisasterandthatinsurancetrulyisadisasterrecoveryplanoflastresort.

[Link]?

[Link].

[Link].

[Link].

[Link].

[Link] 12/25
11/12/2016 [Link]/print?xmlid=9781118105948%2Ftraditional_questions_answers0024
[Link]:

[Link](forexample,fires,floods,andearthquakes),technical(forexample,hardware/softwarefailure,power
disruption,andcommunicationsinterference),andhuman(forexample,riots,strikes,disgruntledemployees,andsabotage).

[Link],competitive
position,customerconfidence,legal/regulatoryrequirements,andcostanalysistominimizeexposure.

[Link]
operations,keypersonnel,information,processingsystems,documentation,vitalrecords,andpoliciesandprocedures.

[Link].

[Link]/disasterrecoveryplanning(BCP/DRP),businessimpactanalysis(BIA)primarilyidentifieswhichofthe
following?

[Link]

[Link]

[Link]

[Link]

[Link](BIA)istheprocessofidentifyinganorganization'sexposuretothesuddenlossofselectedbusinessfunctionsand/orthesupporting
resources(threats)andanalyzingthepotentialdisruptiveimpactofthoseexposures(risks)[Link]
risksareprimaryandcostsandimpactsaresecondary,wherethelatterisderivedfromtheformer.
TheBIAusuallyestablishesacost(impact)associatedwiththedisruptionlastingvaryinglengthsoftime,whichissecondary.

[Link]?

[Link]

[Link]

[Link]

[Link]

[Link],requiringthecorrectversionofsoftwarethatcreatedtheoriginalrecordsis
testedandstoredoffsite,andthatthecurrentsoftwareversionismatchedwiththecurrentversionofvitalrecords.
Theotherthreechoicesareincorrectbecause,althoughtheyareimportantintheirownway,[Link]
ofphysicalsecuritycontrolsincludekeysandlocks,sensors,alarms,sprinklers,[Link],air
conditioning,[Link].

[Link](BCP)?

[Link]

[Link]

[Link]

[Link]

[Link]'s
criticalfunctionsoperatingintheeventofdisruptions,[Link]
[Link].

[Link]?

[Link]?

[Link]?

[Link]?

[Link]?

[Link],what,when,where,andwho,[Link]
[Link]
[Link],thewhatdescribesthecriticalprocessesandresourcerequirements,
thewhendealswithcriticaltimeframes,thewheredescribesrecoverystrategy,[Link]
thehowinformationintheplandocumentconfusespeople,makingithardtounderstandandcreatingamaintenancenightmare.

[Link]?

[Link] 13/25
11/12/2016 [Link]/print?xmlid=9781118105948%2Ftraditional_questions_answers0024
[Link].

[Link].

[Link].

[Link].

[Link]
[Link],[Link]
[Link](offsite)ispreferabletotheprimarylocation(onsite)becauseitensurescontinuityofbusiness
operationsiftheprimarylocationisdestroyedorinaccessible.

[Link],whichofthefollowingtestingoptionscanbecombined?

[Link]

[Link]

[Link]

[Link]

[Link],theteam
membersmeetandwalkthroughthespecificstepsofeachcomponentofthedisasterrecoveryprocessandfindgapsandoverlaps.
Simulationtestingsimulatesadisasterduringnonbusinesshours,[Link]
[Link]'sspecialapproval.

[Link]
toalternativestoragesites?

[Link]

[Link]

[Link]

[Link]

a.1and2

b.1and3

c.2and3

d.2and4

57. b. The frequency of information system backups and the transfer rate of backup information to alternative storage sites should be consistent with the
organization'srecoverytimeobjective(RTO)andrecoverypointobjective(RPO).[Link]
(MTTF)ismostoftenusedwithsafetycriticalsystemssuchasairlinetrafficcontrolsystems(radarcontrolservices)[Link]
betweenoutages (MTBO) is the mean time between equipment failures that result in loss of system continuity or unacceptable degradation. MTTF deals with
softwareissues,whereasMTBOmeasureshardwareproblems.

[Link]:

[Link]'sassurancetosurvive.

[Link].

[Link].

[Link].

[Link],wellrehearsed,[Link]'senvironment,a
localareanetwork(LAN)failurecanbeascatastrophicasanaturaldisaster,[Link].
[Link]
[Link].

[Link]?

[Link]

[Link]

[Link]

[Link]

[Link] 14/25
11/12/2016 [Link]/print?xmlid=9781118105948%2Ftraditional_questions_answers0024
59.c. Management is interested to find out what worked (successful) and what did not (unsuccessful) after a recovery from a disaster. The idea is to learn from
experience.

[Link]?

[Link]

[Link]

[Link]

[Link]

[Link],whereastheotherthreechoicesareexamplesof
[Link],monthtomonth,orannualbasisorotherwiseperformedregularly.
Housing computers in a fireresistant area with a noncombustible or charged sprinkler area is not regular work. It is part of a major computercenter building
constructionplan.

[Link]?

[Link].

[Link].

[Link].

[Link].

[Link],[Link],flawsintheplanmayremainhiddenor
[Link],themostimportantoutcomeistolearnfromthetestresultsinordertoimprovetheplan
nexttime,whichistherealbenefit.

[Link]:

[Link]

[Link]

[Link]

[Link]

[Link]
[Link],andnottothetelephone
company.

[Link],whichofthefollowingisnotanelementofrisk?

[Link]

[Link]

[Link]

[Link]

[Link]/DRPornot,thethreeelementsofriskincludethreats,assets,andmitigatingfactors.
Risksresultfromeventsandtheirsurroundingswithorwithoutpriorwarnings,andincludefacilitiesrisk,physicalandlogicalsecurityrisk,reputationrisk,network
risk,supplychainrisk,compliancerisk,andtechnologyrisk.
Threatsourcesincludenatural(forexample,firesandfloods),manmadeattacks(forexample,socialengineering),technologybasedattacks(DoSandDDoS),and
intentionalattacks(forexample,sabotage).
Assetsincludepeople,facilities,equipment(hardware),software,andtechnologies.
Controlsintheformofphysicalprotection,logicalprotection,[Link]
controlsincludepasswords,smokedetectors,andfirewallsandsomeexamplesofreactive/recoverycontrolsincludehotsitesandcoldsites.
Costsaretheoutcomesorbyproductsofandderivedfromthreats,assets,andmitigatingfactors,whichshouldbeanalyzedandjustifiedalongwithbenefitspriorto
theinvestmentincontrols.

[Link]:

[Link]

[Link]

[Link]

[Link]

[Link] 15/25
11/12/2016 [Link]/print?xmlid=9781118105948%2Ftraditional_questions_answers0024
[Link],waterdamage,heat,[Link]
includeraisedfloors,sprinklers,[Link]
takenintoaccountinacosteffectivemanneratthetimethedata(computer)[Link].

[Link]?

[Link]

[Link]

[Link]

[Link]

[Link]:initialcosts,recurringoperatingcosts,[Link]
componentsareincurredwhetherthebackupfacilityisputintooperationthelastcostcomponentisincurredonlywhenthefacilityisactivated.
Theinitialcostsincludethecostofinitialsetup,includingmembership,[Link]
operating the facility, including rent, utilities, repair, and ongoing backup operations. Activation costs include costs involved in the actual use of the backup
[Link],facilityusagecharges,overtime,transportation,andothercosts.

[Link],themajorobjectiveistoselectthealternativewiththe:

[Link]

[Link]

[Link]

[Link]

[Link]'[Link]
[Link].

[Link]?

[Link].

[Link].

[Link].

[Link].

[Link],regardlessoftheirsize,needwrittencontractsforallcustomers,[Link],andall
agreementsshouldbeinwritingtoavoidmisunderstandingsandperformanceproblems.

[Link]:

[Link]

[Link]

[Link]

[Link]

[Link](PR)officerisacompany'sspokespersonandusesthemediaasavehicletoconsistentlycommunicateandreporttothepublic,includingall
stakeholders, during precrisis, interim, and postcrisis periods. Hence, the PR officer is a reporter, not a stakeholder. Examples of various media used for crisis
notificationincludeprint,radio,television,telephone(voicemailandtextmessages),postoffice(regularmail),theInternet(forexample,electronicmailandblogs),
andpressreleasesorconferences.
Theotherstakeholders(forexample,employees,customers,suppliers,vendors,laborunions,investors,creditors,andregulators)haveavestedinterestinthepositive
andnegativeeffectsandoutcomes,andareaffectedbyacrisissituation,resultingfromthedisasterrecoveryprocess.

[Link]
disasterrecoveryplan?

[Link]

[Link]

[Link]

[Link]

[Link](i)closeenoughtoallowthebackup
functiontobecomeoperationalquickly,(ii)unlikelytobeaffectedbythesamecontingency,(iii)closeenoughtoserveitsusers,and(iv)convenienttoairports,major
highways,ortrainstationswhenlocatedoutoftown.

[Link] 16/25
11/12/2016 [Link]/print?xmlid=9781118105948%2Ftraditional_questions_answers0024
[Link]
adisaster?

[Link]

[Link]

[Link]

[Link]

[Link],telecommunicationslines,intrusiondetectionsystems,and
[Link]
[Link].

[Link]?

[Link]

[Link]

[Link]

[Link]

[Link],sofullscaletesting
[Link]
thetwoparties.
[Link]
[Link],orcould
use,identicalhardware.

[Link]?

[Link]

[Link]

[Link]

[Link]

[Link]
[Link],costaloneshouldnotbetheoverridingfactorwhenmakingbackupfacilitydecisions.

[Link]'sfunctionsareoftenignoredinplanningforrecoveryfromadisaster?

[Link]

[Link]

[Link]

[Link]

[Link],itincludesextendedworkhours,overtimepay,
compensatory time, living costs, employee evacuation, medical treatment, notifying families of injured or missing employees, emergency food, and cash during
[Link],emergencyresponseduringrecovery,[Link]
issuesisthattheyencompassmanyitemsrequiringextensiveplanningandcoordination,whichtakeasignificantamountoftimeandeffort.

[Link]?

[Link]

[Link]

[Link]

[Link]

[Link],themanagementstylesindicatedintheotherthreechoicesareacceptableduetotheinvolvement
[Link],thesituationduringadisasterisentirelydifferentrequiringexecution,[Link]
andcontrol structure, which is a productionoriented management style, is the best approach to orchestrate the recovery, unify all resources, and provide solid
[Link]
suitableduringadisaster.

[Link]:

[Link] 17/25
11/12/2016 [Link]/print?xmlid=9781118105948%2Ftraditional_questions_answers0024
[Link].

[Link].

[Link].

[Link].

[Link]
ofemergencyplanningispersonnelsafety,security,andwelfaresecondaryobjectivesinclude(i)minimizinglossofassets,(ii)minimizingbusinessinterruption,
(iii)providingbackupfacilitiesandservices,and(iv)providingtrainedpersonneltoconductemergencyandrecoveryoperations.

[Link]?

[Link]

[Link]

[Link]

[Link]

[Link]
useful,[Link],butnotwocontingencyplanswillorshouldbethesame.

[Link]:

[Link]

[Link]

[Link]

[Link]

[Link],protectproperty,andminimizetheimpactof
theemergency(losscontrol).Maximizingprofitscanbepracticedduringnonemergencytimesbutnotduringanemergency.

[Link]:

[Link]?

[Link]?

[Link]?

[Link]?

[Link],whatshouldhavehappened,andwhatshouldhappennext,butnoton
[Link].

[Link]:

[Link].

[Link].

[Link].

[Link].

[Link],[Link]
secrecy,[Link].A
[Link]
contact media, issue an initial statement, provide background information, and describe action plans, which are essential to minimize the damage. The company
lawyersmayaddrestrictionstoensurethateverythingisdoneaccordingly,whichmaynotworkwellinanemergency.

[Link]?Havingadisasterrecoveryplanandtestingitregularly:

[Link]

[Link]

[Link]

[Link]

[Link] 18/25
11/12/2016 [Link]/print?xmlid=9781118105948%2Ftraditional_questions_answers0024
[Link],availabilityofspecificinsurancecoverage,[Link]
[Link],[Link]
obtainedfromlossexperience,geography,managementjudgment,thehealthoftheeconomy,[Link]
[Link]
comfortinreducingrisksbutitdoesnotprovidethemeanstoensurecontinuityofbusinessoperations.

[Link],whichofthefollowingcostcategoriesrequiresmanagement'sgreatestattention?

[Link]

[Link]

[Link]

[Link]

81.c. Hidden costs are not insurable expenses and include (i) unemployment compensation premiums resulting from layoffs in the work force, (ii) increases in
advertisingexpendituresnecessarytorebuildthevolumeofbusiness,(iii)costoftrainingnewandoldemployees,and(iv)increasedcostofproductiondueto
[Link],[Link]
[Link],[Link]
expensesandarecapturedbyaccountingsystems.

[Link]
businesses?

[Link]

[Link]

[Link]

[Link]

[Link]
today'sdataandtelecommunicationsnetworkshavepavedthewayforanewbreedofmirroredsites(intelligentsites)thatcanserveasbothprimaryandcontingency
[Link],telecommunications,lifesupport(waterandsanitation),and24hour
security systems. Mirrored sites are fully redundant facilities with automated realtime information mirroring. A mirrored site (redundant site) is equipped and
[Link]
[Link],cold,andwarmsites
areoperatedandmanagedbycommercialorganizations,whereasthemirroredsiteisoperatedbytheuserorganization.

[Link]?

[Link]

[Link]

[Link]

[Link]

[Link]
becomeanightmare,[Link]
required,[Link],[Link]
[Link]
data to less accessible and lower cost storage media. Journaling applications post a copy of each transaction to both the local and remote storage sites when
applicable.

[Link]:

[Link]

[Link]

[Link]

[Link]

[Link](i.e.,credibility,reputation,andgoodwill)[Link]
[Link],[Link],public(media)relationshipsrequireaproactive
[Link]'[Link]
[Link],[Link]
media,moretimeisavailabletomanagetheactualdaytodayaspectsofcrisiscommunicationsduringthedisaster.

[Link]?

[Link]

[Link] 19/25
11/12/2016 [Link]/print?xmlid=9781118105948%2Ftraditional_questions_answers0024
[Link]

[Link]

[Link]

[Link],asthenameimplies,disruptsnormaloperationsandshouldbeapproachedwithcaution.

[Link]:

[Link]

[Link]

[Link]

[Link]

[Link],workstations,applications,[Link]
comprehensivestudyofthistypeiscompleted,variousbackup,access,storage,availability,andretentionstrategiescanbeevaluatedtodeterminewhichstrategybest
fitstheneedsofanorganization.

[Link]?

[Link]

[Link]

[Link]

[Link]

[Link],flooding,[Link]
[Link]
[Link],andtheyareofteninaccurate.

[Link]:

[Link].

[Link].

[Link].

[Link].

[Link]
[Link](batteriesandgenerators),abackupwatersource,andasupplyofgasoline
[Link]
debrisandtopreventlooting.

[Link]?

[Link],powerrequirements,andairconditioningrequirements

[Link]

[Link]

[Link]

[Link],fuel,
[Link],television,[Link]
[Link]
andphonenumbersaswellasescalationlevels.

[Link]?

[Link].

[Link].

[Link].

[Link].

[Link] 20/25
11/12/2016 [Link]/print?xmlid=9781118105948%2Ftraditional_questions_answers0024
[Link](LAN)isunavailableforan
extended period of time. Application systems should be scheduled for recovery and operation at the alternative site, based on their priority, the urgency of the
information,[Link]
becausetheyarenotthedirectusersofthesystem.

[Link],atwhatstageshouldapplicationsystemsberecovered?

[Link]

[Link]

[Link]

[Link]

[Link]
[Link]
masterfilesordatabasesdependingontheirschedules.

[Link]?

[Link]

[Link]

[Link]

[Link]

[Link]
[Link],theamountoftimeandeffortspentontheotherthreechoicesandthedegreeofperfection
[Link],thebetterthe
[Link],[Link]
fromcarefulimplementationofthatplaninactions.

[Link]'seffectivepresentationofdisasterscenariosshouldbebasedonwhichofthefollowing?

[Link]

[Link]

[Link]

[Link]

[Link],describingthetypesofincidentsthatanorganizationislikelytoexperience,shouldbebasedoneventsorsituationsthatareseverein
magnitude (high in damages and longer in outages), occurring at the worst possible time (i.e., worstcase scenario with pessimistic time), resulting in severe
impairmenttotheorganization'sabilitytoconductand/orcontinueitsbusinessoperations.
The planning horizon for these scenarios include shortterm (i.e., less than one month outage) and longterm (i.e., more than three month outage), the severity
magnitudelevelsincludelow,moderate,andhighandthetiminglevelsincludeworstpossibletime,mostlikelytime,[Link]
[Link]
scenariosintermsofseverityandtiminglevelsexceptthattheysupporttheseverityandtiminglevelsindirectly.

[Link]:

[Link]

[Link]

[Link]

[Link]

[Link],notontheprobabilitythatitmayor
maynothappen.

[Link]?

[Link].

[Link].

[Link].

[Link].

[Link] 21/25
11/12/2016 [Link]/print?xmlid=9781118105948%2Ftraditional_questions_answers0024
[Link],thetimeforrecoveryofapplicationsincategoryI
couldbelessthan8hoursafterdisasterdeclaration(highpriority).ThetimeframeforrecoveryofcategoryIVapplicationscouldbelessthan12hoursafterdisaster
declaration(lowpriority).

[Link]:

[Link]

[Link]

[Link]

[Link]

[Link]
[Link]
[Link].
A list of equipment, software, forms, and supplies needed to operate contingency category I (high priority) applications should be available to use as a damage
assessmentchecklist.

[Link]?

[Link]

[Link]

[Link]

[Link]

[Link],remotejournalingorelectronicvaultingcouldbeconductedoveraconnectionwithlimitedor
[Link],[Link]
connection.

[Link](BCP)processshouldfocusonprovidingwhichofthefollowing?

[Link]

[Link]

[Link]

[Link]

[Link](BCP)processshouldsafeguardanorganization'scapabilitytoprovideaminimumacceptablelevelofoutputsandservicesin
[Link]
effortstooperatetheorganization'scorebusinessprocesseswithintheconstraintssuchasadisastertime.

[Link]?

[Link]

[Link]

[Link]

[Link]

[Link]
[Link]
physical distances where network latency could occur. Consequently, shadowing helps to preserve the protected server's performance. Both synchronous and
asynchronousaretechniquesandvariationsofdiskreplication(i.e.,singleandmultiplelocationdiskreplication).

[Link],anorganizationobtainswhichofthefollowingtoreducethelikelihoodofasinglepointoffailure?

[Link]

[Link]

[Link]

[Link]

100. c. An organization obtains alternative telecommunications services to reduce the likelihood of encountering a single point of failure with primary
[Link].

[Link]?

[Link] 22/25
11/12/2016 [Link]/print?xmlid=9781118105948%2Ftraditional_questions_answers0024
[Link]

[Link]

[Link]

[Link]

101.d. Management commitment and involvement are always needed for any major programs, and developing a disaster recovery plan is no exception. Better
[Link].

[Link]/disasterrecoveryplanning(BCP/DRP),riskanalysisispartofwhichofthefollowing?

[Link]

[Link]

[Link]

[Link]

[Link]
[Link].

[Link]?

[Link]

[Link]

[Link]

[Link]

[Link].Somebusinessesoperateona24x7scheduleand
losingseveralhoursofproductiontimeistantamounttoanotherdisaster,financiallyorotherwise.

[Link](BIA)shouldcriticallyexaminethebusinessprocessesandwhichofthefollowing?

[Link]

[Link]

[Link]

[Link]

[Link](BIA)examinesbusinessprocessescompositionandpriorities,businessoroperatingcycles,servicelevels,and,mostimportant,
thebusinessprocessdependencyonmissioncriticalinformationsystems.

[Link]:

[Link],softwarethreats,andenvironmentalthreats

[Link]

[Link]

[Link]

105. c. Physical and environmental controls help prevent contingencies. Although many of the other controls, such as logical access controls, also prevent
contingencies,themajorthreatsthatacontingencyplanaddressesarephysicalandenvironmentalthreats,suchasfires,lossofpower,plumbingbreaks,ornatural
[Link].

[Link]?

[Link]

[Link]

[Link]

[Link]

[Link],notallapplicationsystemshavetobesupportedwhilethelocalareanetwork(LAN)[Link]
maybehandledmanually,someasstandalonePCtasks,[Link],itisnotsoclearwhich
[Link]
[Link].
[Link] 23/25
11/12/2016 [Link]/print?xmlid=9781118105948%2Ftraditional_questions_answers0024

[Link]?

[Link]

[Link]

[Link]

[Link]

[Link](BIA)istoidentifycriticalfunctions,resources,andvitalrecordsnecessaryforanorganizationtocontinueitscritical
[Link],[Link]
constituteadescriptionornarrativeofaspecificsituationorcondition.

[Link]/DRP,singlepointoffailuremeanswhichofthefollowing?

[Link]

[Link]

[Link]

[Link]

[Link],equipment,facilities,systems,[Link]
[Link](RAID)technologyprovidesgreaterdatareliabilitythroughredundancybecausethedatacan
bestoredonmultipleharddrivesacrossanarray,thuseliminatingsinglepointsoffailureanddecreasingtheriskofdatalosssignificantly.

[Link]?

[Link]

[Link]

[Link]

[Link]

[Link]
butequippedwithenvironmentalcontrols(forexample,heatandairconditioning)[Link].A
redundantsiteisconfiguredexactlyliketheprimarysite.

110. Whichofthefollowingcomputerbackupalternativesitesistheleastexpensivemethodandthemostdifficulttotest?

[Link]

[Link]

[Link]

[Link]

[Link],wiring,andhumiditycontrolforcontinuedprocessingwhenthe
[Link],butthemostdifficultandexpensivetotest.

111. Whichofthefollowingisthecorrectsequenceofeventswhensurvivingadisaster?

[Link],recover,plan,continue,andtest

[Link],respond,recover,test,andcontinue

[Link],plan,test,recover,andcontinue

[Link],test,respond,recover,andcontinue

[Link],test,respond,recover,andcontinue.

112. Whichofthefollowingtoolsprovideinformationforreachingpeopleduringadisaster?

[Link]

[Link]

[Link]

[Link]

[Link] 24/25
11/12/2016 [Link]/print?xmlid=9781118105948%2Ftraditional_questions_answers0024
[Link]
[Link]
[Link],andaparsetreediagramcanbeusedin
estimatingprobabilitiesandthenatureofstatesinsoftwareengineering.

[Link] 25/25