Chapter 8 Review Questions

1. The ultimate obstacles to business continuity are threats that may include which
of the following?
A. Natural disasters
B. Missed targets
C. Loss of profit
D. All of the above
2. When planning team assignments, it is most important to remember which of
the following?
A. Nobody should hold more than one team assignment.
B. The number of people or number of teams is not as important as making sure
all the duties are performed.
C. A single key person can be assigned to all teams for consistency.
D. The number of duties is the same for each team.
3. What is the biggest difference between disaster planning and business
continuity planning?
A. Disaster plans are usually specific to a department.
B. Business continuity plans are run by IT.
C. Business continuity plans span department boundaries.
D. Disaster planning is an extension of facility plans.
4. What is the principal reason you might use a hot site?
A. It’s already configured for your use
B. May not be available during a crisis
C. You will have to install and configure new equipment
D. Expensive and prevents you from using other warm or cold site alternatives
5. What does the term MAO stand for?
A. Minimum acceptable outage
B. Maximum acceptable outage
C. Minimum available on hand
D. Maximum available overnight
6. In business continuity, why is it important to replicate every process?
A. To ensure 100 percent full operational capabilities.
B. To minimize the impact of market reactions.
C. It’s not important; only select processes will continue.
D. To protect the company reputation.
7. Which of the following acronyms refers to the expected level of service
during recovery?
A. RTO
B. SDO
 C. RPO
D. ITO
8. A critical success factor is defined as which of the following?
A. A measure or score of efficiency
B. An asset to be planned
C. Something that must occur perfectly every time
D. A factor that is calculated for insurance purposes
9. Which of these is the most significant issue to consider regarding insurance
coverage?
A. Salvage rather than replacement may be dictated.
B. Premiums may be very expensive.
C. Coverage must include all business assets.
D. Insurance can pay for all the costs of recovery.
1. Name one of the purposes of creating a business continuity plan.
A. To maximize the number of decisions made during an incident
B. To minimize decisions needed during a crisis
C. To lower business insurance premiums
D. To provide guidance for federal regulations
11. What does the acronym EOC represent?
A. Emergency Office Complex
B. Evacuate Office Center
C. Emergency Offensive Controls
D. Emergency Operations Center
2. News media attention should be________________.
A. Directed to a single designated spokesperson
B. Used to create awareness of the crisis and warn the public
C. Restricted to prevent any information from being released
D. Allowed full access to interview staff
3. What are the best examples of vital records and media?
A. Specialized forms, financial records, how-to manuals, backup tapes
B. Past annual reports, last year’s cancelled checks, vacation forms, HR policies
C. Preferred vendor lists, personal desk files, extra blank paper for copy machine
D. Customer lists, office supplies, maintenance manuals, corporate seal
4. Which of the following should be considered when setting your business
continuity strategy?
A. Recovery time objectives
B. Alternate sites available
C. Testing time available at alternate sites
D. All of the above
5. What is the process to activate the business continuity plan?
 A. Members of the organization call the recovery site to activate.
B. Management designates decision criteria and appoints authorized personnel.
C. The facility manager receives a severe threat warning.
D. The senior manager on duty makes the decision.
6. What is the fundamental difference between disaster recovery and
business continuity?
A. Disaster recovery is focused on natural disasters; business continuity deals
with man-made events.
B. Business continuity is focused on ensuring that none of the services
are interrupted; disaster recovery deals with restoring services.
C. Disaster recovery is focused on rebuilding; business continuity deals with
revenue to continue in the market.
D. Business continuity is focused on protecting the IT investment; disaster
recovery applies to the entire organization.
7. What indicators are used to identify the anticipated level of recovery and loss
at a given point in time?
A. RPO and RTO
B. RTO and SDO
C. RPO and ITO
D. SDO and IRO
8. What are the five phases of business continuity planning according to ISACA?
(Select the answer showing the correct phases and order.)
A. Analyze business impact, develop strategy, develop plan, plan testing, implement
B. Analyze business impact, develop plan, implement, plan testing, write the plan
C. Analyze business impact, write the plan, test strategy, develop plan, implement
D. Analyze business impact, develop strategy, develop plan, implement, plan testing
9. When can a warm site be used for recovery?
A. When the downtime is acceptable to the business without breaching any
legal requirements
B. When it’s not profitable to operate a hot site
C. When the recovery is of high priority
D. When the actual recovery exceeds the recovery time objective
1. When can continuity planners create BC plans without the business impact
analysis (BIA) process?
A. When business impact analysis is not required.
B. When management already dictated all the key processes to be used.
C. It’s not possible; critical processes constantly change.
D. If risk assessment is acceptable.
2. What should signal that the business continuity plan needs to be updated?
 A. Time and market conditions
B. Personnel changes
C. Significant changes in business objectives or direction
D. All of the above
3. Why is plan testing important?
A. To prove that the plan worked the first time
B. To find and correct problems
C. To show that the team is not pulling their own weight
D. To verify that everyone shows up at the recovery site
4. Which of the following methods of testing BC/DR plans is not acceptable?
A. Desktop
B. Modular
C. Full interruption
D. Unannounced
5. Which of these is the primary output from the business impact analysis (BIA)?
A. Identification of alternate revenue opportunities
B. Analysis of dependencies and areas of overreliance
C. High-level understanding of definitions
D. Low-level blueprint of the business process
6. Which of the following definitions is the best example of an RTO?
A. Target point of optimum data recovery
B. Target time for the user to be processing again with all work recovered.
C. Target service level at a particular point in time
D. Target for recovery to be completed