Which of the following is MOST important in determining whether a disaster recovery test is successful?
To ensure that a disaster recovery test is successful, it is most important to determine whether all critical business functions
were successfully recovered and duplicated. Although ensuring that only materials taken from offsite storage are used in the
test is important, this is not as critical in determining a test's success. While full recovery of the processing infrastructure is a
key recovery milestone, it does not ensure the success of a test. Achieving the RTOs is another important milestone, but
does not necessarily prove that the critical business functions can be conducted, due to interdependencies with other
applications and key elements such as data, staff, manual processes, materials and accessories, etc.
An organization with multiple data centers has designated one of its own facilities as the recovery site. The MOST important
concern is the:
If data centers are operating at or near capacity, it may prove difficult to recover critical operations at an alternate data
center. Although line capacity is important from a mirroring perspective, this is secondary to having the necessary capacity to
restore critical systems. By comparison, differences in logical and physical security and synchronization of system software
releases are much easier issues to overcome and are, therefore, of less concern.
A post-incident review should be conducted by an incident management team to determine:
Post-incident reviews are beneficial in determining ways to improve the response process through lessons learned from the
attack. Evaluating the relevance of evidence, who launched the attack or what areas were affected are not the primary
purposes for such a meeting because these should have been already established during the response to the incident.
The BEST approach in managing a security incident involving a successful penetration should be to:
Since information security objectives should always be linked to the objectives of the business, it is imperative that business
processes be allowed to continue whenever possible. Only when there is no alternative should these processes be
interrupted. Although it is important to allow the security team to assess the characteristics of an attack, this is subordinate to
the needs of the business. Permitting an incident to continue may expose the organization to additional damage. Evaluating
the incident management process for deficiencies is valuable but it, too, is subordinate to allowing business processes to
An incident response policy must contain:
Escalation criteria, indicating the circumstances under which specific actions are to be undertaken, should be contained
within an incident response policy. Telephone trees, press release templates and lists of critical backup files are too detailed
to be included in a policy document.
At the conclusion of a disaster recovery test, which of the following should ALWAYS be performed prior to leaving the
vendor's hot site facility?
For security and privacy reasons, all organizational data and software should be erased prior to departure. Evaluations can
occur back at the office after everyone is rested, and the overall results can be discussed and compared objectively.
Which of the following is the MOST important element to ensure the success of a disaster recovery test at a vendor-provided
Disaster recovery testing requires the allocation of sufficient resources to be successful. Without the support of
management, these resources will not be available, and testing will suffer as a result. Testing on weekends can be
advantageous but this is not the most important choice. As vendor-provided hot sites are in a state of constant change, it is
not always possible to have network addresses defined in advance. Although it would be ideal to provide for identical
equipment at the hot site, this is not always practical as multiple customers must be served and equipment specifications will
Which of the following is the MOST important to ensure a successful recovery?
Unless backup media are available, all other preparations become meaningless. Recovery site location and security are
important, but would not prevent recovery in a disaster situation. Having a secondary hot site is also important, but not as
important as having backup media available. Similarly, alternate data communication lines should be tested regularly and
successfully but, again, this is not as critical.
The FIRST priority when responding to a major security incident is:
The first priority in responding to a security incident is to contain it to limit the impact. Documentation, monitoring and
restoration are all important, but they should follow containment.
The BEST method for detecting and monitoring a hacker's activities without exposing information assets to unnecessary risk
is to utilize:
Decoy files, often referred to as honeypots, are the best choice for diverting a hacker away from critical files and alerting
security of the hacker's presence. Firewalls and bastion hosts attempt to keep the hacker out, while screened subnets or
demilitarized zones (DM/.s) provide a middle ground between the trusted internal network and the external untrusted