22 Continuity, Disaster Recovery & Awareness Practice Questions & Answers

Every Continuity, Disaster Recovery & Awareness practice question from the ISC2 Certified in Cybersecurity (CC) Practice Test, with the correct answer and a short explanation.

Start practice test →

1. A continuity planner maps how a warehouse's order system operates and finds that every transaction crosses one router, fed by one power supply and one internet circuit. What has the planner identified, and what principle addresses it?
- A.A recovery objective; the remedy is shortening the device's restore time
- B.A residual risk; the remedy is accepting it because the device is monitored
- C.A compliance gap; the remedy is recording the device in the asset inventory
- D.A single point of failure; the remedy is building redundancy into that path✓ Answer
Redundancy exists to eliminate single points of failure: a component whose loss halts an entire business function. Monitoring, inventory entries and faster restores may each be worthwhile, but only duplicating the component and its path removes the dependency itself.
Source: ISC2 Certified in Cybersecurity Exam Outline, Security Governance, Understand redundancyReport a problem with this question
2. During a regional flood a firm's staff relocate to a temporary office and keep taking customer orders on paper, while the technology group rebuilds servers from backups at another data center. How should these two activities be classified?
- A.Taking orders on paper is business continuity; rebuilding the servers is disaster recovery✓ Answer
- B.Taking orders on paper is disaster recovery; rebuilding the servers is business continuity
- C.Both activities are disaster recovery, because management formally declared a disaster
- D.Both activities are business continuity, because the continuity plan was activated first
Business continuity keeps critical business functions running while the disruption is under way and is people-and-process focused, so improvised paper order-taking is continuity. Disaster recovery is the technical subset that restores systems, data and facilities, so rebuilding servers is recovery.
Source: NIST SP 800-34, Contingency Planning Guide for Federal Information Systems, plan types and relationshipsReport a problem with this question
3. A board member asks what the business continuity plan is meant to deliver that the disaster recovery plan does not. Which answer is correct?
- A.It restores servers, applications and facilities to their normal operating state after the event
- B.It detects and contains security incidents before they can disrupt business operations
- C.It keeps mission-critical business functions operating while the disruption continues✓ Answer
- D.It certifies the organization against an external information security standard each year
The continuity plan's purpose is uninterrupted delivery of mission-critical functions during a disruption, using alternate people, sites and manual workarounds. Restoring technology is the disaster recovery plan's job, and detection and containment belong to incident response.
Source: ISC2 Certified in Cybersecurity Exam Outline, Security Governance, Understand redundancyReport a problem with this question
4. A security manager beginning continuity planning is told to simply adopt the four-hour recovery target that the IT team already chose. Why is that the wrong place to start?
- A.Recovery targets are fixed by regulation, so an organization cannot select its own
- B.The disaster recovery plan sets the recovery targets, and the continuity plan adopts them
- C.The business impact analysis ranks critical functions and derives the recovery targets✓ Answer
- D.The risk register sets recovery targets once residual risk has been formally accepted
The business impact analysis is the foundation of continuity planning: it identifies mission-critical functions, ranks their criticality and weighs quantitative and qualitative impact, and the recovery objectives fall out of that analysis. Recovery targets are an output of the analysis, never an input handed to it.
Source: NIST SP 800-34, Contingency Planning Guide, Business Impact AnalysisReport a problem with this question
5. A retailer's plan states that after any failure the business must not lose more than one hour of recorded sales transactions. Which objective does this express, and what mainly determines whether it can be met?
- A.The recovery point objective, set mainly by how often data is backed up or replicated✓ Answer
- B.The maximum tolerable downtime, set mainly by how long customers will wait for service
- C.The recovery time objective, set mainly by how quickly staff can rebuild a failed server
- D.The mean time between failures, set mainly by how reliable the storage hardware is
The recovery point objective states the maximum tolerable data loss expressed in time, so it looks backward from the moment of failure. Backup or replication frequency sets it directly: if data is captured only once an hour, up to an hour of work can be lost.
Source: NIST SP 800-34, Contingency Planning Guide, recovery point objective definitionReport a problem with this question
6. A continuity team records a maximum tolerable downtime of eight hours for a claims system. Technology can restore the platform in six hours, after which claims staff need three more hours to clear the backlog before the function is genuinely running again. What should the team conclude?
- A.The plan passes, because the six-hour restoration is already shorter than the eight hours
- B.The plan fails, because restoration plus work recovery time must fit inside the eight hours✓ Answer
- C.The plan passes, because work recovery time is counted separately from tolerable downtime
- D.The plan fails, because tolerable downtime must always exceed the recovery point objective
Maximum tolerable downtime is the outer business limit on an outage, and the function is not restored until the work backlog is cleared. Six hours of restoration plus three hours of work recovery is nine hours, which exceeds the eight-hour limit, so the design must be improved.
Source: NIST SP 800-34, Contingency Planning Guide, maximum tolerable downtime and recovery time objectiveReport a problem with this question
7. An analyst briefing new staff needs one sentence that separates the two most confused recovery metrics. Which statement is accurate?
- A.The recovery time objective measures tolerable data loss; the recovery point objective measures restoration speed
- B.Both metrics measure elapsed outage time, and the recovery point objective is always the stricter of the two
- C.The recovery point objective measures tolerable data loss; the recovery time objective measures restoration speed✓ Answer
- D.Both metrics are set by the technology team, and the business accepts whichever values can be delivered
The recovery point objective looks backward from the failure and caps how much data may be lost, while the recovery time objective looks forward and caps how long restoration may take. Both are business decisions derived from the impact analysis, not technical preferences.
Source: NIST SP 800-34, Contingency Planning Guide, recovery objectivesReport a problem with this question
8. A firm takes a full backup every Sunday. Scheme A adds a nightly backup of everything changed since Sunday; Scheme B adds a nightly backup of everything changed since the previous night. A failure occurs on Thursday. Which comparison is correct?
- A.Scheme A restores from the full set plus one nightly set; Scheme B needs the full set plus every nightly set✓ Answer
- B.Both schemes restore from the full backup alone, because nightly sets only shorten the backup window
- C.Both schemes need every nightly set, and the only difference lies in how long each backup takes
- D.Scheme B restores from the full set plus one nightly set; Scheme A needs the full set plus every nightly set
Scheme A is a differential backup, capturing everything changed since the last full backup, so recovery needs the full set plus only the most recent differential. Scheme B is an incremental backup, capturing changes since the previous backup of any type, so every incremental in the chain is required.
Source: NIST SP 800-34, Contingency Planning Guide, backup methods (full, incremental, differential)Report a problem with this question
9. Ransomware encrypts a company's file servers, and the backup appliance sitting on the same network is encrypted as well. Which backup practice would most directly have preserved a usable recovery copy?
- A.Keeping synchronous replication to a second array so the copy stays perfectly current
- B.Keeping one copy offline or immutable so running malware cannot reach or alter it✓ Answer
- C.Keeping the backup appliance patched and behind the same firewall as the servers
- D.Keeping a one-year retention window so older file versions remain available on it
Any copy the malware can reach over the network can be encrypted with everything else, which is why the three-two-one rule ends with a copy kept offsite and out of reach. An offline or write-once copy survives because the running process has no path to modify it.
Source: CISA #StopRansomware Guide, maintain offline and immutable backupsReport a problem with this question
10. A system owner argues that nightly backups are unnecessary because the storage array mirrors every write onto a second set of disks. What is the flaw in that argument?
- A.Mirroring protects against disk failure only when the two disk sets sit in separate buildings
- B.Mirroring protects against disk failure, but it copies deletions and corruption just as faithfully✓ Answer
- C.Mirroring counts as a backup, but the offsite copy requirement is met only after replication
- D.Mirroring counts as a backup, provided a restore test verifies the array at least once a year
Mirroring and replication are availability controls: they keep a service running when hardware fails, but they reproduce every change instantly, including an accidental deletion or a ransomware encryption. A backup is a point-in-time copy you can return to, which mirroring does not provide.
Source: NIST SP 800-34, Contingency Planning Guide, disk redundancy versus data backupReport a problem with this question
11. A firm's business impact analysis sets a four-hour recovery target for its trading platform, while finance prefers the cheapest alternate site on offer. Which choice should the continuity manager defend?
- A.A cold site, because it meets the requirement for a documented alternate site at the least cost
- B.A warm site, because hardware is already racked and the data can be loaded within days
- C.A hot site, because the four-hour target leaves no time to install and load systems elsewhere✓ Answer
- D.A reciprocal agreement, because a peer firm can host the platform at no recurring cost
Alternate sites trade cost against speed: a cold site offers only space and power and takes weeks, a warm site has hardware but needs data loaded over days, and a hot site is live within minutes or hours. Cost may not override a recovery objective the business has already approved.
Source: NIST SP 800-34, Contingency Planning Guide, alternate site types (cold, warm, hot, mirrored)Report a problem with this question
12. Two competing firms consider a mutual-aid arrangement under which each would host the other's processing after a disaster. Which concern should governance raise first?
- A.Mutual-aid arrangements are forbidden whenever the two organizations compete in one market
- B.Mutual-aid arrangements cost more each year than leasing a dedicated hot site would cost
- C.Neither firm may sign such an arrangement without prior approval from a national regulator
- D.Spare capacity may be missing exactly when it is needed, and each would see the other's data✓ Answer
A reciprocal or mutual-aid agreement is the cheapest alternate-site option, which is exactly why its weaknesses are tested: the partner's spare capacity is unverified and may be consumed by its own workload, and hosting a rival's processing exposes confidential data. Nothing prohibits the arrangement, but governance must weigh those risks.
Source: NIST SP 800-34, Contingency Planning Guide, reciprocal agreements as alternate processing optionsReport a problem with this question
13. An administrator reports a full year of successful nightly backup jobs and asks the auditor to close the finding on recoverability. What should the auditor require before closing it?
- A.Evidence of offsite rotation, because a completed job still leaves every copy in one building
- B.Evidence of encryption at rest, because a completed job still leaves the copy readable
- C.Evidence of a test restore, because a completed job is not proof that data can be recovered✓ Answer
- D.Evidence of longer retention, because a completed job overwrites last month's copy set
A backup job reports only that data was written; media faults, incomplete data sets and unusable catalogs surface only when someone attempts a restore. Continuity practice holds that an untested backup is not a recovery capability, so the evidence required is a successful test restore.
Source: NIST SP 800-53, Contingency Planning control family, testing of information system backupsReport a problem with this question
14. A continuity plan written three years ago still names a data center the company closed last year. Under governance principles, who is accountable for keeping the plan current, and what should trigger a review?
- A.The security team is accountable; reviews are triggered only when an external audit is announced
- B.The facilities group is accountable; reviews are triggered when a building lease is ended
- C.Internal audit is accountable; reviews are triggered whenever a finding is formally raised
- D.Senior management is accountable; reviews are triggered on a schedule and after major changes✓ Answer
Governance assigns ownership and approval of continuity plans to senior management, while the security team drafts and maintains the document on their behalf. Plans must be reviewed on a defined cycle and additionally after any significant organizational, technical or facility change, and after a real event.
Source: NIST SP 800-34, Contingency Planning Guide, plan maintenance and management responsibilityReport a problem with this question
15. A fire alarm sounds in a data center while a critical database restore is running, and the on-site engineer asks whether to stay until the restore finishes. What does continuity planning direct?
- A.Evacuate once the alarm is confirmed genuine, because false alarms interrupt recovery work
- B.Stay until the restore finishes, because an interrupted restore can corrupt the database
- C.Stay until a manager authorizes leaving, because the restore sits on the critical path
- D.Evacuate immediately, because protecting human life outranks any system or data recovery✓ Answer
Every continuity and emergency plan ranks life safety above asset and data recovery, which is why the occupant emergency plan takes precedence once an alarm sounds. Data can be restored again from backups, and staff are required to evacuate rather than verify the alarm themselves.
Source: OSHA 29 CFR 1910.38, Emergency Action Plans, evacuation priority for employeesReport a problem with this question
16. A programme sends every employee a two-minute reminder and a simulated phishing message each month, while database administrators attend a hands-on secure-configuration workshop. How should the two efforts be classified?
- A.The monthly reminders are training; the administrators' workshop is formal security education
- B.The monthly reminders are awareness; the administrators' workshop is role-based training✓ Answer
- C.Both efforts are education, because both are meant to change employee behavior over time
- D.Both efforts are awareness, because both are delivered to employees by the security team
Awareness is short, recurring reinforcement aimed at keeping security top of mind and changing everyday behavior, such as reminders and simulated phishing. Training builds a specific skill tied to a job role, while education is broad, long-horizon study such as a degree or certification.
Source: NIST SP 800-50, Building an Information Technology Security Awareness and Training Program, awareness versus training versus educationReport a problem with this question
17. Two divisions run the identical awareness curriculum. In one, an executive opens each session and reports phishing results at the all-hands meeting; in the other, the security team simply emails the material. The first division reports far more suspicious messages. What best explains the difference?
- A.Visible leadership sponsorship signals that secure behavior is genuinely expected✓ Answer
- B.Longer course duration gave the first division more practice with the material
- C.Stronger technical controls stopped more messages before employees ever saw them
- D.Mandatory completion tracking forced the first division to finish every module
Security culture is driven by tone at the top: when leaders visibly sponsor the programme and discuss results, employees read secure behavior as an expectation of the job rather than an optional extra. The curriculum was identical in both divisions, so content cannot explain the gap.
Source: ISC2 Certified in Cybersecurity Exam Outline, Security Governance, Understand security awareness (organizational culture, security leadership)Report a problem with this question
18. After an employee who clicked a phishing link was named and reprimanded at a company meeting, reporting of suspicious email fell sharply across the organization. What should security leadership change?
- A.Add a disciplinary point system for repeat clickers, since consequences focus attention
- B.Make reporting blame-free and simple, since punishment pushes mistakes out of sight✓ Answer
- C.Publish the names of employees who fail simulations, since peer pressure aids vigilance
- D.Stop running phishing simulations, since they damage trust between staff and security
Awareness programmes depend on people reporting quickly, and punishment teaches staff that silence is safer, which lengthens the time an attack goes unnoticed. A blame-free process with an easy reporting path raises report rates, which is the measure the programme actually needs.
Source: NIST SP 800-50, Building an Information Technology Security Awareness and Training Program, program effectiveness and incident reportingReport a problem with this question
19. An employee asks which single habit best protects her work account if a convincing fake sign-in page ever captures her password. Which guidance is most accurate?
- A.Turn on multifactor authentication, so a stolen password alone cannot open the account✓ Answer
- B.Add symbols and digits to the password, so a captured value resists cracking tools
- C.Change the password every 30 days, so a stolen one expires before it can be misused
- D.Reuse one very strong password everywhere, so there is a single secret to safeguard
When a phishing page captures a password, the secret is already known to the attacker, so complexity and rotation schedules do not help within that window. A second factor means the stolen password by itself is not sufficient to authenticate, which is why it is the strongest single mitigation for credential phishing.
Source: NIST SP 800-63B, Digital Identity Guidelines, authenticator assurance and multifactor authenticationReport a problem with this question
20. A governance dashboard carries two figures: the average number of days taken to deploy critical patches last quarter, and the steadily rising rate at which an AI fraud-detection model's outputs diverge from validated results. How should the two figures be classified?
- A.Patch deployment time is a key performance indicator; the growing model drift is a key risk indicator✓ Answer
- B.Both figures are key performance indicators, because both are computed from historical system data
- C.Both figures are key risk indicators, because both are reported to executives on one dashboard
- D.Patch deployment time is a key risk indicator; the growing model drift is a key performance indicator
A key performance indicator looks backward and reports how well a control or process actually performed, such as patch deployment time. A key risk indicator looks forward and warns that exposure is building, and worsening model drift is exactly that kind of early signal about future availability and accuracy of the service.
Source: ISC2 Certified in Cybersecurity Exam Outline, Security Governance, Measure cybersecurity effectiveness (key metrics and key risk indicators)Report a problem with this question
21. Notices appear in the staff parking lot telling employees to scan a QR code to revalidate their parking permits. The code opens a page that imitates the company sign-in portal. Which technique is this, and what is the right response?
- A.Smishing; report the notice and text the parking office to confirm the campaign
- B.Quishing; report the notice and reach company services only by known internal links✓ Answer
- C.Baiting; report the notice and scan the code on a personal phone instead of a laptop
- D.Whaling; report the notice and forward it to executives so they can verify the campaign
Phishing delivered through a malicious QR code is called quishing, and it works because the destination address is hidden inside the image until the page has already loaded. The countermeasure is the same for every phishing variant: reach the service through an address you already know rather than through the one supplied to you.
Source: ISC2 Certified in Cybersecurity Exam Outline, Security Governance, Understand security awareness (social engineering, phishing)Report a problem with this question
22. A finance clerk takes a call from someone whose voice matches the CFO's exactly, referring to a genuine project and demanding an urgent payment to a new bank account. Synthetic voice is now cheap to produce. What should the clerk do?
- A.Complete the payment, because the caller's voice and project knowledge confirm identity
- B.Send the payment and email the CFO afterwards so a wrong transfer can be reversed
- C.Ask the caller a personal question, because an impersonator could not answer it
- D.Call back on the number already held for the CFO and verify before any payment✓ Answer
Voice recognition and inside knowledge are no longer reliable proof of identity, because synthetic audio can reproduce a familiar voice and project details are often public or previously stolen. Out-of-band callback on a number held independently of the request is the standard defence against payment fraud of this kind.
Source: FBI Internet Crime Complaint Center guidance on business email compromise: verify payment change requests using known contact informationReport a problem with this question

Practice questions based on the ISC2 Certified in Cybersecurity (CC) Exam Outline. This site is not affiliated with or endorsed by ISC2, and these are not real exam questions. ISC2 revises the domains and their weights periodically and sets the exam length, passing standard and eligibility terms — confirm the current outline and requirements with ISC2 before you register. Official CC exam outline →

1. A continuity planner maps how a warehouse's order system operates and finds that every transaction crosses one router, fed by one power supply and one internet circuit. What has the planner identified, and what principle addresses it?

2. During a regional flood a firm's staff relocate to a temporary office and keep taking customer orders on paper, while the technology group rebuilds servers from backups at another data center. How should these two activities be classified?

3. A board member asks what the business continuity plan is meant to deliver that the disaster recovery plan does not. Which answer is correct?

4. A security manager beginning continuity planning is told to simply adopt the four-hour recovery target that the IT team already chose. Why is that the wrong place to start?

5. A retailer's plan states that after any failure the business must not lose more than one hour of recorded sales transactions. Which objective does this express, and what mainly determines whether it can be met?

6. A continuity team records a maximum tolerable downtime of eight hours for a claims system. Technology can restore the platform in six hours, after which claims staff need three more hours to clear the backlog before the function is genuinely running again. What should the team conclude?

7. An analyst briefing new staff needs one sentence that separates the two most confused recovery metrics. Which statement is accurate?

8. A firm takes a full backup every Sunday. Scheme A adds a nightly backup of everything changed since Sunday; Scheme B adds a nightly backup of everything changed since the previous night. A failure occurs on Thursday. Which comparison is correct?

9. Ransomware encrypts a company's file servers, and the backup appliance sitting on the same network is encrypted as well. Which backup practice would most directly have preserved a usable recovery copy?

10. A system owner argues that nightly backups are unnecessary because the storage array mirrors every write onto a second set of disks. What is the flaw in that argument?

11. A firm's business impact analysis sets a four-hour recovery target for its trading platform, while finance prefers the cheapest alternate site on offer. Which choice should the continuity manager defend?

12. Two competing firms consider a mutual-aid arrangement under which each would host the other's processing after a disaster. Which concern should governance raise first?

13. An administrator reports a full year of successful nightly backup jobs and asks the auditor to close the finding on recoverability. What should the auditor require before closing it?

14. A continuity plan written three years ago still names a data center the company closed last year. Under governance principles, who is accountable for keeping the plan current, and what should trigger a review?

15. A fire alarm sounds in a data center while a critical database restore is running, and the on-site engineer asks whether to stay until the restore finishes. What does continuity planning direct?

16. A programme sends every employee a two-minute reminder and a simulated phishing message each month, while database administrators attend a hands-on secure-configuration workshop. How should the two efforts be classified?

18. After an employee who clicked a phishing link was named and reprimanded at a company meeting, reporting of suspicious email fell sharply across the organization. What should security leadership change?

19. An employee asks which single habit best protects her work account if a convincing fake sign-in page ever captures her password. Which guidance is most accurate?

20. A governance dashboard carries two figures: the average number of days taken to deploy critical patches last quarter, and the steadily rising rate at which an AI fraud-detection model's outputs diverge from validated results. How should the two figures be classified?

21. Notices appear in the staff parking lot telling employees to scan a QR code to revalidate their parking permits. The code opens a page that imitates the company sign-in portal. Which technique is this, and what is the right response?

22. A finance clerk takes a call from someone whose voice matches the CFO's exactly, referring to a genuine project and demanding an urgent payment to a new bank account. Synthetic voice is now cheap to produce. What should the clerk do?