EC-Council EDRP flashcards
EC-Council EDRP · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Business Impact Analysis
- Process that identifies critical business functions, quantifies the operational and financial impact of their loss over time, and derives RTO and RPO targets that drive recovery strategy selection.
- Recovery Time Objective
- The maximum acceptable elapsed time to restore a business process or system after disruption. It defines how fast recovery must occur, not how much data may be lost.
- Recovery Point Objective
- The maximum acceptable volume of data loss expressed as time measured backward from the failure. An RPO of 15 minutes permits losing at most the last 15 minutes of transactions.
- Maximum Tolerable Downtime
- The total time a business function can be unavailable before consequences become unacceptable. RTO plus workaround time must remain within this limit; it is set by business owners.
- Hot Site
- A fully equipped alternate facility with replicated data and ready infrastructure enabling recovery within minutes to hours. It offers the lowest RTO at the highest recurring cost.
- Warm Site
- An alternate site with power, connectivity, and partial hardware but without live data replication. Recovery typically takes hours to a day and requires restoring backups.
- Cold Site
- An alternate facility providing only space, power, cooling, and connectivity. All systems and data must be procured and restored, so RTO is measured in days or weeks.
- Pilot Light Strategy
- A minimal core environment kept running in a secondary location, such as replicated data stores. On disaster, the core is scaled up into full production, giving moderate RTO and low cost.
- Full Interruption Test
- A DR exercise that shuts down the primary site and shifts all operations to the recovery site. It provides the strongest assurance but carries the highest operational risk.
- Tabletop Exercise
- A discussion-based walkthrough where participants respond to a simulated scenario using the plan. It validates roles, decisions, and communications without touching production systems.
- 3-2-1 Backup Rule
- Keep at least three copies of data, on two different media types, with one copy stored offsite. An added immutable or offline copy protects against ransomware encryption.
- Immutable Backup
- A backup stored in a write-once or retention-locked repository that cannot be altered or deleted during its retention window, defeating ransomware attempts to destroy recovery data.
- Restore Testing
- Periodically recovering data from backups into a test environment and verifying integrity and usability. Untested backups are unverified assumptions, not a recovery capability.
- Mean Time To Repair
- The average time required to restore a failed component or service to working condition, measured from failure detection to restoration. Lower MTTR directly raises calculated availability.
- Availability Calculation
- Availability equals MTBF divided by the sum of MTBF and MTTR. Reducing repair time improves availability without changing the underlying failure rate of components.
- Single Point of Failure
- Any component whose failure alone halts a critical service, such as one power feed, one network link, or one administrator. It must be eliminated or mitigated in the DR design.
- Geographic Redundancy
- Placing recovery infrastructure far enough from the primary site that a single regional disaster, such as flood or grid failure, cannot disable both environments simultaneously.
- Continuity of Operations Plan
- A documented plan describing how an organization sustains essential functions during disruption, including authority succession, alternate locations, manual procedures, and communication channels.
- Disaster Declaration
- A formal decision, made against predefined criteria by named authorities, that activates the DR plan and authorizes failover, spending, and notification of stakeholders.
- Emergency Operations Center
- A designated physical or virtual command location where the crisis team coordinates damage assessment, resource allocation, and communications during an incident or declared disaster.
- Crisis Communications Plan
- Prepared procedures and contact lists for notifying employees, customers, regulators, and media during disruption, including out-of-band channels that survive primary system outages.
- Reciprocal Agreement
- An arrangement where two organizations permit each other to use facilities or systems during a disaster. It is inexpensive but risky because both parties may be affected by the same event.
- Work Area Recovery
- Provision of alternate workspace, seating, and telephony for staff when the primary building is unusable, addressing the people and facilities dimension rather than data systems.
- ISO 22301
- The international standard for business continuity management systems, structured on Plan-Do-Check-Act and covering BIA, risk assessment, continuity strategies, exercises, and continual improvement.
- Recovery Time Tiering
- Grouping systems into tiers by RTO so that funding and technology match business criticality, preventing overinvestment in low-criticality assets and underinvestment in vital ones.
- Dependency Mapping
- Documenting upstream and downstream relationships between processes, applications, data, suppliers, and infrastructure so recovery order respects true dependencies rather than org charts.
- Manual Workaround
- A documented interim procedure, such as paper forms or spreadsheets, that sustains a critical function while systems are unavailable, and includes reconciliation steps after restoration.
- Plan Maintenance Trigger
- A defined event that forces DR plan review, such as major architecture change, new critical application, staff turnover in key roles, audit finding, or a completed exercise with corrective actions.
- Lessons Learned Review
- A structured post-exercise or post-incident analysis capturing what worked, what failed, and assigned corrective actions with owners and due dates, feeding back into plan revision.
- Data Replication
- Continuous copying of changes from primary to secondary storage. Synchronous replication gives near-zero RPO but adds latency; asynchronous replication lowers latency but permits some data loss.
- Failover Versus Failback
- Failover moves operations to the recovery environment during disaster; failback returns them to the primary site. Failback is often slower and requires resynchronization and validation.
- Recovery Strategy Selection
- Choosing a recovery approach by balancing RTO, RPO, cost, and risk. Options include active-active, hot, warm, cold, backup-restore, and manual workaround, selected per system tier.