a. Respond, recover, plan, continue, and test
b. Plan, respond, recover, test, and continue
c. Respond, plan, test, recover, and continue
d. Plan, test, respond, recover, and continue
111. d. The correct sequence of events to take place when surviving a disaster is plan, test, respond, recover, and continue.
112. Which of the following tools provide information for reaching people during a disaster?
a. Decision tree diagram
b. Call tree diagram
c. Event tree diagram
d. Parse tree diagram
112. b. A call tree diagram shows who to contact when a required person is not available or not responding. The call tree shows the successive levels of people to contact if no response is received from the lower level of the tree. It shows the backup people when the primary person is not available. A decision tree diagram shows all the choices available with their outcomes to make a decision. An event tree diagram can be used in project management, and a parse tree diagram can be used in estimating probabilities and the nature of states in software engineering.
Scenario-Based Questions, Answers, and Explanations
Use the following information to answer questions 1 through 7.
The GKM Company has just completed the business impact analysis (BIA) for its data processing facilities. The continuity planning team found in the risk analysis that there is a single point of failure in that backup tapes from offsite locations are controlled by an individual who works for the vendor. The contract for the vendor does not expire for 3 years.
1. Which of the following uses both qualitative and quantitative tools?
a. Anecdotal analysis
b. Business impact analysis
c. Descriptive analysis
d. Narrative analysis
1. b. The purpose of BIA is to identify critical functions, resources, and vital records necessary for an organization to continue its critical functions. In this process, the BIA uses both quantitative and qualitative tools. The other three choices are incorrect because they are examples that use qualitative tools. Anecdotal records constitute a description or narrative of a specific situation or condition.
2. With respect to business continuity planning/disaster recovery planning (BCP/DRP), risk analysis is part of which of the following?
a. Cost-benefit analysis
b. Business impact analysis
c. Backup analysis
d. Recovery analysis
2. b. The risk analysis is usually part of the business impact analysis (BIA). It estimates both the functional and financial impact of a risk occurrence to the organization and identifies the costs to reduce the risks to an acceptable level through the establishment of effective controls. Cost-benefit analysis, backup analysis, and recovery analysis are part of the BIA.
3. With respect to BCP/DRP, the BIA identifies which of the following?
a. Threats and risks
b. Costs and impacts
c. Exposures and functions
d. Events and operations
3. a. BIA is the process of identifying an organization’s exposure to the sudden loss of selected business functions and/or the supporting resources (threats) and analyzing the potential disruptive impact of those exposures (risks) on key business functions and critical business operations. The BIA usually establishes a cost (impact) associated with the disruption lasting varying lengths of time.
4. The business impact analysis (BIA) should critically examine the business processes and which of the following?
a. Composition
b. Priorities
c. Dependencies
d. Service levels
4. c. The business impact analysis (BIA) examines business processes composition and priorities, business or operating cycles, service levels, and, most important, the business process dependency on mission-critical information systems.
5. The major threats that a disaster recovery and contingency plan should address include which of the following?
a. Physical threats, software threats, and environmental threats
b. Physical threats and environmental threats
c. Software threats and environmental threats
d. Hardware threats and logical threats
