Examen:

CISSP - (ISC)2 Certified Information Systems Security Professional - Chapter 03

James was recently asked by his organization’s CIO to lead a core team of four experts through a business continuity planning process for his organization.

1.-What is the first step that this core team should undertake?
A. BCP team selection
B. Business organization analysis
C. Resource requirements analysis
D. Legal and regulatory assessment

Tracy is preparing for her organization’s annual business continuity exercise and encounters resistance from some managers who don’t see the exercise as important and feel that it is a waste of resources. She has already told the managers that it will only take half a day for their employees to participate.

2.-What argument could Tracy make to best address these concerns?
A. The exercise is required by policy.
B. The exercise is already scheduled and canceling it would be difficult.
C. The exercise is crucial to ensuring that the organization is prepared for emergencies.
D. The exercise will not be very time-consuming.

The board of directors of Clashmore Circuits conducts an annual review of the business continuity planning process to ensure that adequate measures are in place to minimize the effect of a disaster on the organization’s continued viability.

3.-What obligation are they satisfying by this review?
A. Corporate responsibility
B. Disaster requirement
C. Due diligence
D. Going concern responsibility

Darcy is leading the BCP effort for her organization and is currently in the project scope and planning phase.

4.-What should she expect will be the major resource consumed by the BCP process during this phase?
A. Hardware
B. Software
C. Processing time
D. Personnel

Ryan is assisting with his organization’s annual business impact analysis effort. He’s been asked to assign quantitative values to assets as part of the priority identification exercise.

5.-What unit of measure should he use?
A. Monetary
B. Utility
C. Importance
D. Time

Renee is reporting the results of her organization’s BIA to senior leaders. They express frustration at all of the detail, and one of them says, “Look, we just need to know how much we should expect these risks to cost us each year.”

6.-What measure could Renee provide to best answer this question?
A. ARO
B. SLE
C. ALE
D. EF

Jake is conducting a business impact analysis for his organization. As part of the process, he asks leaders from different units to provide input on how long the enterprise resource planning (ERP) system could be unavailable without causing irreparable harm to the organization.

7.-What measure is he seeking to determine?
A. SLE
B. EF
C. MTD
D. ARO

You are concerned about the risk that an avalanche poses to your $3 million shipping facility. Based on expert opinion, you determine that there is a 5 percent chance that an avalanche will occur each year. Experts advise you that an avalanche would completely destroy your building and require you to rebuild on the same land. Ninety percent of the $3 million value of the facility is attributed to the building, and 10 percent is attributed to the land itself.

8.-What is the single loss expectancy (SLE) of your shipping facility to avalanches?
A. $3 million
B. $2,700,000
C. $270,000
D. $135,000

9.-Referring to the scenario in question 8, what is the annualized loss expectancy?
A. $3 million
B. $2,700,000
C. $270,000
D. $135,000

You are concerned about the risk that a hurricane poses to your corporate headquarters in South Florida. The building itself is valued at $15 million. After consulting with the National Weather Service, you determine that there is a 10 percent likelihood that a hurricane will strike over the course of a year. You hired a team of architects and engineers, who determined that the average hurricane would destroy approximately 50 percent of the building.

10.-What is the annualized loss expectancy (ALE)?
A. $750,000
B. $1.5 million
C. $7.5 million
D. $15 million

Chris is completing the risk acceptance documentation for his organization’s business continuity plan.

11.-Which one of the following items is Chris least likely to include in this documentation?
A. Listing of risks deemed acceptable
B. Listing of future events that might warrant reconsideration of risk acceptance decisions
C. Risk mitigation controls put in place to address acceptable risks
D. Rationale for determining that risks were acceptable

Brian is developing continuity plan provisions and processes for his organization.

12.-What resource should he protect as the highest priority in those plans?
A. Physical plant
B. Infrastructure
C. Financial
D. People

Ricky is conducting the quantitative portion of his organization’s business impact analysis.

13.-Which one of the following concerns is least suitable for quantitative measurement during this assessment?
A. Loss of a plant
B. Damage to a vehicle
C. Negative publicity
D. Power outage

Lighter than Air Industries expects that it would lose $10 million if a tornado struck its aircraft operations facility. It expects that a tornado might strike the facility once every 100 years.

14.-What is the single loss expectancy for this scenario?
A. 0.01
B. $10 million
C. $100,000
D. 0.10

15.-Referring to the scenario in question 14, what is the annualized loss expectancy?
A. 0.01
B. $10 million
C. $100,000
D. 0.10

16.-In which business continuity planning task would you actually design procedures and mechanisms to mitigate risks deemed unacceptable by the BCP team?
A. Strategy development
B. Business impact analysis
C. Provisions and processes
D. Resource prioritization

Matt is supervising the installation of redundant communications links in response to a finding during his organization’s BIA.

17.-What type of mitigation provision is Matt overseeing?
A. Hardening systems
B. Defining systems
C. Reducing systems
D. Alternative systems

Helen is working on her organization’s resilience plans, and her manager asks her whether the organization has sufficient technical controls in place to recover operations after a disruption.

18.-What type of plan would address the technical controls associated with alternate processing facilities, backups, and fault tolerance?
A. Business continuity plan
B. Business impact analysis
C. Disaster recovery plan
D. Vulnerability assessment

Darren is concerned about the risk of a serious power outage affecting his organization’s data center. He consults the organization’s business impact analysis and determines that the ARO of a power outage is 20 percent. He notes that the assessment took place three years ago and no power outage has occurred.

19.-What ARO should he use in this year’s assessment, assuming that none of the circumstances underlying the analysis have changed?
A. 20 percent
B. 50 percent
C. 75 percent
D. 100 percent

20.-Of the individuals listed, who would provide the best endorsement for a business continuity plan’s statement of importance?
A. Vice president of business operations
B. Chief information officer
C. Chief executive officer
D. Business continuity manager