Читать книгу (ISC)2 CISSP Certified Information Systems Security Professional Official Study Guide - Mike Chapple - Страница 197

1 James was recently asked by his organization's CIO to lead a core team of four experts through a business continuity planning process for his organization. What is the first step that this core team should undertake?BCP team selectionBusiness organization analysisResource requirements analysisLegal and regulatory assessment

2 Tracy is preparing for her organization's annual business continuity exercise and encounters resistance from some managers who don't see the exercise as important and feel that it is a waste of resources. She has already told the managers that it will only take half a day for their employees to participate. What argument could Tracy make to best address these concerns?The exercise is required by policy.The exercise is already scheduled and canceling it would be difficult.The exercise is crucial to ensuring that the organization is prepared for emergencies.The exercise will not be very time-consuming.

3 The board of directors of Clashmore Circuits conducts an annual review of the business continuity planning process to ensure that adequate measures are in place to minimize the effect of a disaster on the organization's continued viability. What obligation are they satisfying by this review?Corporate responsibilityDisaster requirementDue diligenceGoing concern responsibility

4 Darcy is leading the BCP effort for her organization and is currently in the project scope and planning phase. What should she expect will be the major resource consumed by the BCP process during this phase?HardwareSoftwareProcessing timePersonnel

5 Ryan is assisting with his organization's annual business impact analysis effort. He's been asked to assign quantitative values to assets as part of the priority identification exercise. What unit of measure should he use?MonetaryUtilityImportanceTime

6 Renee is reporting the results of her organization's BIA to senior leaders. They express frustration at all of the detail, and one of them says, “Look, we just need to know how much we should expect these risks to cost us each year.” What measure could Renee provide to best answer this question?AROSLEALEEF

7 Jake is conducting a business impact analysis for his organization. As part of the process, he asks leaders from different units to provide input on how long the enterprise resource planning (ERP) system could be unavailable without causing irreparable harm to the organization. What measure is he seeking to determine?SLEEFMTDARO

8 You are concerned about the risk that an avalanche poses to your $3 million shipping facility. Based on expert opinion, you determine that there is a 5 percent chance that an avalanche will occur each year. Experts advise you that an avalanche would completely destroy your building and require you to rebuild on the same land. Ninety percent of the $3 million value of the facility is attributed to the building, and 10 percent is attributed to the land itself. What is the single loss expectancy (SLE) of your shipping facility to avalanches?$3 million$2,700,000$270,000$135,000

9 Referring to the scenario in question 8, what is the annualized loss expectancy?$3 million$2,700,000$270,000$135,000

10 You are concerned about the risk that a hurricane poses to your corporate headquarters in South Florida. The building itself is valued at $15 million. After consulting with the National Weather Service, you determine that there is a 10 percent likelihood that a hurricane will strike over the course of a year. You hired a team of architects and engineers, who determined that the average hurricane would destroy approximately 50 percent of the building. What is the annualized loss expectancy (ALE)?$750,000$1.5 million$7.5 million$15 million

11 Chris is completing the risk acceptance documentation for his organization's business continuity plan. Which one of the following items is Chris least likely to include in this documentation?Listing of risks deemed acceptableListing of future events that might warrant reconsideration of risk acceptance decisionsRisk mitigation controls put in place to address acceptable risksRationale for determining that risks were acceptable

12 Brian is developing continuity plan provisions and processes for his organization. What resource should he protect as the highest priority in those plans?Physical plantInfrastructureFinancialPeople

13 Ricky is conducting the quantitative portion of his organization's business impact analysis. Which one of the following concerns is least suitable for quantitative measurement during this assessment?Loss of a plantDamage to a vehicleNegative publicityPower outage

14 Lighter than Air Industries expects that it would lose $10 million if a tornado struck its aircraft operations facility. It expects that a tornado might strike the facility once every 100 years. What is the single loss expectancy for this scenario?0.01$10 million$100,0000.10

15 Referring to the scenario in question 14, what is the annualized loss expectancy?0.01$10 million$100,0000.10

16 In which business continuity planning task would you actually design procedures and mechanisms to mitigate risks deemed unacceptable by the BCP team?Strategy developmentBusiness impact analysisProvisions and processesResource prioritization

17 Matt is supervising the installation of redundant communications links in response to a finding during his organization's BIA. What type of mitigation provision is Matt overseeing?Hardening systemsDefining systemsReducing systemsAlternative systems

18 Helen is working on her organization's resilience plans, and her manager asks her whether the organization has sufficient technical controls in place to recover operations after a disruption. What type of plan would address the technical controls associated with alternate processing facilities, backups, and fault tolerance?Business continuity planBusiness impact analysisDisaster recovery planVulnerability assessment

19 Darren is concerned about the risk of a serious power outage affecting his organization's data center. He consults the organization's business impact analysis and determines that the ARO of a power outage is 20 percent. He notes that the assessment took place three years ago and no power outage has occurred. What ARO should he use in this year's assessment, assuming that none of the circumstances underlying the analysis have changed?20 percent50 percent75 percent100 percent

20 Of the individuals listed, who would provide the best endorsement for a business continuity plan's statement of importance?Vice president of business operationsChief information officerChief executive officerBusiness continuity manager