I85PREP
⌘ K
EC-Council EDRP study materials
EC-Council EDRP study resources

EC-Council EDRP practice questions

One question at a time. Build your EC-Council EDRP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Business Continuity and Disaster Recovery

In disaster recovery planning, which metric defines the maximum acceptable amount of data loss measured in time before an incident, expressed as the interval between the last backup and the failure?

  1. Maximum tolerable downtime (MTD)
  2. Recovery point objective (RPO) Correct answer.
  3. Recovery time objective (RTO)
  4. Service level objective (SLO)

Explanation

The recovery point objective expresses how far back in time a recovery may restore data, so it directly caps acceptable data loss rather than outage duration. RTO and MTD describe time to restore service and total tolerable outage, not the data rollback window.

Question 2Business Continuity and Disaster Recovery

A DR plan requires that a critical database failover complete within 30 minutes of a declared disaster. Which planning term best describes this 30-minute requirement?

  1. Retention period
  2. Recovery time objective Correct answer.
  3. Recovery point objective
  4. Mean time between failures

Explanation

A recovery time objective specifies the target duration within which a system must be restored after disruption. It is a time-to-restore commitment, distinct from data-loss tolerance and from reliability metrics such as MTBF.

Question 3Business Continuity and Disaster Recovery

Which type of recovery site is fully equipped with hardware, connectivity, and current data so that operations can resume almost immediately, at the highest ongoing cost?

  1. Warm site
  2. Cold site
  3. Reciprocal agreement
  4. Hot site Correct answer.

Explanation

A hot site is maintained in a ready state with replicated systems and near-current data, enabling rapid resumption but requiring substantial recurring expense. Warm and cold sites trade lower cost for longer recovery times.

Question 4Business Continuity and Disaster Recovery

An organization classifies systems by criticality so that restoration resources are applied in priority order during a disaster. Which document most directly defines this ordering and the associated recovery steps?

  1. Disaster recovery plan Correct answer.
  2. Acceptable use policy
  3. Risk register
  4. Business impact analysis

Explanation

The disaster recovery plan documents recovery priorities, roles, and step-by-step procedures for restoring systems in sequence. The BIA supplies impact data that informs priorities but does not itself contain recovery procedures.

Question 5Business Continuity and Disaster Recovery

Which activity in a business impact analysis primarily determines the point in time at which a business function's disruption becomes unacceptable?

  1. Testing intrusion detection signatures
  2. Auditing user access recertification
  3. Reviewing firewall rule change history
  4. Calculating the maximum tolerable downtime for each function Correct answer.

Explanation

A BIA quantifies how long each function can be unavailable before impact becomes intolerable, producing the maximum tolerable downtime used to set recovery targets. The other activities are security operations tasks unrelated to impact quantification.

Question 6Business Continuity and Disaster Recovery

Which backup strategy copies all selected data every time a backup runs, simplifying restoration but consuming the most storage and backup window time?

  1. Continuous data protection
  2. Full backup Correct answer.
  3. Incremental backup
  4. Differential backup

Explanation

A full backup captures the entire data set at each run, so restoration needs only the latest copy, but storage and window requirements are highest. Incremental and differential schemes reduce backup cost at the price of more complex restores.

Question 7Business Continuity and Disaster Recovery

During a declared disaster, which role is typically accountable for authorizing plan activation and communicating with executive leadership?

  1. Disaster recovery coordinator Correct answer.
  2. Backup tape operator
  3. Help desk analyst
  4. Network monitoring vendor

Explanation

The DR coordinator or crisis manager holds authority to declare and escalate, coordinating executive communication and plan execution. Operational staff and vendors perform technical tasks under that direction.

Question 8Business Continuity and Disaster Recovery

Which test type involves relocating staff to an alternate site and performing actual recovery procedures, providing the highest confidence at the greatest cost and risk?

  1. Tabletop exercise
  2. Checklist review
  3. Structured walkthrough
  4. Full interruption test Correct answer.

Explanation

A full interruption test exercises real recovery at an alternate location, including staff relocation and system restoration, yielding strong assurance but risking production disruption. Lower-tier tests validate plans only on paper or in discussion.

Question 9Business Continuity and Disaster Recovery

A company replicates its primary data center to a secondary region and requires that recovery restore data no older than 15 minutes. Which combination of targets matches this requirement?

  1. RPO of 15 minutes with a separately defined RTO Correct answer.
  2. RTO of 15 minutes with an undefined RPO
  3. RPO of 15 hours with an RTO of 15 minutes
  4. MTD of 15 minutes with no RPO

Explanation

The data-loss tolerance maps to the recovery point objective, so a 15-minute maximum loss means an RPO of 15 minutes. The RTO governs restore speed and must be set independently based on outage tolerance.

Question 10Business Continuity and Disaster Recovery

An organization needs near-zero data loss for a transactional system but can tolerate a two-hour outage. Which design decision best satisfies these targets?

  1. Asynchronous replication with a four-hour RTO
  2. Nightly full backups combined with a two-hour RTO
  3. Synchronous replication to a secondary site combined with a two-hour RTO Correct answer.
  4. Weekly archival copies combined with a two-hour RTO

Explanation

Near-zero data loss requires synchronous replication so committed transactions exist at the remote site, while the two-hour outage tolerance sets the RTO. Backup-only schemes cannot approach zero RPO.

Question 11Business Continuity and Disaster Recovery

A DR plan states that restoration of the payment platform must begin within one hour of declaration and complete within four hours. Which pair of metrics is being specified?

  1. A retention window of one hour plus an RTO of four hours
  2. An RPO of one hour plus an RTO of four hours
  3. An activation trigger time plus an RTO of four hours Correct answer.
  4. An MTD of one hour plus an RPO of four hours

Explanation

The one-hour figure is a response or activation threshold governing when recovery work starts, and the four-hour completion target is the RTO. Neither figure describes acceptable data loss, so RPO is not in play.

Question 12Business Continuity and Disaster Recovery

A hospital must keep its electronic records available through a regional power failure lasting up to 48 hours. Which strategy most directly addresses that continuity requirement?

  1. A cold site 200 kilometers away
  2. On-site generator with fuel contracts sized for 48 hours of load Correct answer.
  3. Off-site tape rotation with weekly pickup
  4. Cloud archival storage with 24-hour retrieval

Explanation

Extended power loss is addressed by on-site generation capacity matched to the required duration plus fuel resupply arrangements. Remote archival and cold sites address data loss and site loss, not immediate power continuity.

Question 13Business Continuity and Disaster Recovery

A recovery plan assumes a warm site with 24-hour activation but the business impact analysis shows the order-entry system can be down only four hours. What is the most appropriate conclusion?

  1. The site strategy does not meet the RTO and must be upgraded or supplemented Correct answer.
  2. The plan is acceptable because warm sites are industry standard
  3. The RPO requirement is satisfied so no change is needed
  4. The BIA should be revised to allow a 24-hour outage

Explanation

When the achievable recovery time exceeds the RTO derived from impact analysis, the strategy is inadequate and must change, for example by adding hot-site capacity or replication. Adjusting the BIA to match a weak control inverts the correct planning direction.

Question 14Business Continuity and Disaster Recovery

Which element of a disaster recovery plan specifies the criteria and authority for declaring a disaster and invoking recovery procedures?

  1. Configuration baseline
  2. Vulnerability management standard
  3. Activation and escalation procedures Correct answer.
  4. Data retention schedule

Explanation

Activation criteria define the thresholds and named authorities that formally invoke the plan and trigger escalation. Retention, baselines, and vulnerability standards govern other control areas.

Question 15Business Continuity and Disaster Recovery

An organization performs a test in which the team reviews each plan step with responsible parties and identifies gaps without touching production systems. Which test type is this?

  1. Simulation with live failover
  2. Parallel test
  3. Full interruption test
  4. Tabletop exercise Correct answer.

Explanation

A tabletop exercise is a discussion-based review of roles and procedures that surfaces gaps without operational risk. Parallel and full interruption tests actually run recovery systems.

Question 16Business Continuity and Disaster Recovery

After a DR test reveals that restoration took twice the documented RTO, what is the most appropriate next step in the plan maintenance cycle?

  1. Perform root cause analysis, update procedures or resources, and retest Correct answer.
  2. File the test report and schedule the next annual test
  3. Remove the affected system from the plan scope
  4. Reduce the documented RTO to match observed performance

Explanation

Test deviations drive corrective action: identify causes, remediate procedures or capacity, and verify through retesting. Altering the target to match poor performance or dropping scope conceals the risk.

Question 17Business Continuity and Disaster Recovery

Which backup approach stores only blocks or files changed since the most recent backup of any kind, making restoration require the last full plus a chain of successive backups?

  1. Incremental backup Correct answer.
  2. Full backup
  3. Snapshot cloning
  4. Differential backup

Explanation

Incremental backups capture changes since the previous backup regardless of type, so restoration replays the full plus every increment in order. Differential backups require only the full plus the latest differential.

Question 18Business Continuity and Disaster Recovery

An organization wants to validate that backups are recoverable without endangering production data. Which practice best achieves this?

  1. Verifying that backup jobs report success in the console
  2. Increasing backup retention to one year
  3. Restoring selected backups to an isolated recovery environment on a scheduled basis Correct answer.
  4. Encrypting backups with a single shared key

Explanation

Only an actual restore into an isolated environment proves that backup data and procedures produce working systems. Job success status and retention changes do not demonstrate recoverability.

Question 19Business Continuity and Disaster Recovery

Which document establishes the sequence in which business functions and their supporting systems must be restored after a disaster?

  1. Security awareness curriculum
  2. Enterprise risk appetite statement
  3. Change advisory board charter
  4. Disaster recovery plan with recovery prioritization Correct answer.

Explanation

The DR plan encodes recovery sequencing derived from BIA criticality, ensuring dependencies are restored in the right order. Risk appetite, training, and change governance documents do not define restoration order.

Question 20Business Continuity and Disaster Recovery

A firm maintains a secondary site with hardware and connectivity but relies on restoring data from backup before use. Which site type is described and what is its typical tradeoff?

  1. Hot site, offering immediate recovery at low cost
  2. Reciprocal site, offering guaranteed capacity at no cost
  3. Cold site, offering immediate recovery at high cost
  4. Warm site, offering moderate cost with hours-to-days recovery Correct answer.

Explanation

A warm site has infrastructure in place but needs data restoration and configuration, yielding moderate cost and intermediate recovery time. Hot sites recover fastest at high cost, cold sites slowest at low cost.

Question 21Business Continuity and Disaster Recovery

An e-commerce platform has an RTO of 15 minutes and an RPO of 1 minute. Which architecture most plausibly satisfies both targets?

  1. Single region with nightly full backups and weekly offsite rotation
  2. Cold standby in a second region with manual restore from tape
  3. Warm standby with daily differential backups
  4. Active-active deployment across regions with synchronous or near-synchronous replication Correct answer.

Explanation

A one-minute RPO and fifteen-minute RTO demand continuous replication and rapid traffic shifting, which active-active multi-region design provides. Backup-based and cold or warm standby models cannot meet either target.

Question 22Business Continuity and Disaster Recovery

Two systems share a database dependency. System A has an RTO of two hours and System B has an RTO of eight hours, but B must be restored before A can function. How should the recovery sequence be planned?

  1. Restore A first because its RTO is shorter
  2. Defer both to the next business day to simplify coordination
  3. Restore B first within a window that still allows A to meet its two-hour RTO Correct answer.
  4. Restore both simultaneously regardless of dependency

Explanation

Dependency order overrides nominal RTO ranking, so the prerequisite system must be restored early enough that the dependent system still meets its tighter target. This may require tightening B's effective recovery time.

Question 23Business Continuity and Disaster Recovery

A DR plan relies on a single replication link between sites. Analysis shows a regional fiber cut could sever both primary and backup connectivity. Which finding should the review record?

  1. An RPO breach requiring immediate failover
  2. A satisfied control because replication exists
  3. A common-mode single point of failure that undermines the recovery strategy Correct answer.
  4. A documentation gap with no technical impact

Explanation

A shared dependency that can disable both primary and recovery paths is a common-mode failure, meaning the strategy may not deliver its promised RTO or RPO. The finding calls for diverse paths or an alternate recovery mechanism.

Question 24Business Continuity and Disaster Recovery

Leadership asks whether the organization could survive losing its primary data center for two weeks. Which analysis output most directly answers this question?

  1. Maximum tolerable downtime compared with the achievable recovery time for each critical function Correct answer.
  2. The current patch compliance percentage
  3. A list of open vulnerability scan findings
  4. The count of privileged accounts in the directory

Explanation

Comparing tolerable downtime against realistic recovery capability shows whether a two-week outage is survivable and where gaps exist. Security posture metrics do not answer outage endurance questions.

Question 25Business Continuity and Disaster Recovery

A recovery plan requires a validated offline copy of backups protected from ransomware encryption of the production network. Which control best satisfies this requirement?

  1. Backups encrypted with a key stored on the same production server
  2. Backups stored on a network share with domain-authenticated write access
  3. Backups replicated to a second volume on the same storage array
  4. Immutable, air-gapped or offline backup copies with periodic restore testing Correct answer.

Explanation

Ransomware resilience requires copies that cannot be altered or deleted by compromised credentials, such as immutable or offline media, plus proof that restores work. Shared-path, same-array, or co-located key designs leave the copies exposed.

Question 26Business Continuity and Disaster Recovery

Which metric defines the maximum acceptable amount of data, measured in time, that an organization can lose after a disruption to a critical system?

  1. Recovery point objective Correct answer.
  2. Service level objective
  3. Maximum tolerable downtime
  4. Recovery time objective

Explanation

The recovery point objective (RPO) expresses tolerable data loss as the time between the last recoverable copy and the moment of failure, so it drives backup and replication frequency. Recovery time objective instead describes how quickly service must be restored, and maximum tolerable downtime describes the overall outage limit for a business function.

Question 27Business Continuity and Disaster Recovery

Which statement correctly distinguishes a business continuity plan from a disaster recovery plan?

  1. The BCP is a technical runbook, while the DRP is a communications plan for regulators.
  2. The BCP addresses continued operation of business functions during disruption, while the DRP focuses on restoring IT infrastructure and data. Correct answer.
  3. The BCP applies only to cyber incidents, while the DRP applies only to natural disasters.
  4. The BCP focuses on restoring servers and data, while the DRP addresses continued operation of business functions.

Explanation

Business continuity planning is business-oriented: it keeps critical functions such as order processing or patient intake operating during and after disruption. Disaster recovery planning is the IT-focused subset that restores infrastructure, applications, and data that support those functions.

Question 28Business Continuity and Disaster Recovery

During a business impact analysis, which factor is used to rank business functions for recovery priority?

  1. The financial and operational impact of each function's outage over time Correct answer.
  2. The physical size of each department's office space
  3. The number of staff assigned to each function
  4. The age of the applications supporting each function

Explanation

A BIA ranks functions by the consequences of their unavailability, quantified over time through financial loss, regulatory exposure, safety, and reputational impact. These time-based impact curves justify recovery sequencing and the RTOs assigned downstream to systems.

Question 29Business Continuity and Disaster Recovery

What is the primary purpose of a disaster recovery plan's communication and escalation section?

  1. Listing the technical steps to fail over a database cluster
  2. Recording the vendor contracts for hardware maintenance
  3. Defining contact hierarchies, notification methods, and escalation triggers for plan activation Correct answer.
  4. Documenting the results of the last DR exercise

Explanation

The communications and escalation section specifies who is notified, in what order, through which channels, and what conditions trigger escalation to disaster declaration. It ensures the right decision-makers and stakeholders are engaged quickly when an incident threatens recovery objectives.

Question 30Business Continuity and Disaster Recovery

An organization wants an alternate processing site that is fully equipped and ready to take over with minimal delay. Which site type meets this requirement?

  1. Reciprocal agreement
  2. Cold site
  3. Hot site Correct answer.
  4. Warm site

Explanation

A hot site is preconfigured with hardware, connectivity, and current data so operations can resume with minimal downtime. Warm sites require some setup and data restoration, and cold sites provide only space and basic infrastructure.

Question 31Business Continuity and Disaster Recovery

Which activity should occur first when an incident is detected that may exceed the organization's tolerable downtime?

  1. Contacting the hardware vendor for replacement parts
  2. Notifying all employees via the mass notification system
  3. Executing data restoration from the most recent backup
  4. Activating the documented disaster declaration and escalation process Correct answer.

Explanation

The declaration and escalation process determines whether the event meets disaster criteria and authorizes invocation of the plan and its associated resources. Restoration, broad notification, and vendor engagement follow the declaration so actions are coordinated and authorized.

Question 32Business Continuity and Disaster Recovery

Which plan element defines the maximum acceptable outage duration for a business function before the impact becomes unacceptable?

  1. Recovery time actual
  2. Mean time to repair
  3. Maximum tolerable downtime Correct answer.
  4. Recovery point objective

Explanation

Maximum tolerable downtime (MTD) is the total elapsed time a function can be unavailable before the organization suffers unacceptable harm. RTOs are then set below the MTD to leave margin for recovery execution.

Question 33Business Continuity and Disaster Recovery

Which characteristic is essential for a backup copy intended to satisfy the recovery requirement for a ransomware event that encrypts production storage?

  1. The copy is compressed to reduce storage cost
  2. The copy is written to a tape library that remains mounted in the backup server
  3. The copy is offline or immutable and stored separately from the production network Correct answer.
  4. The copy is stored on the same storage array as production for fast restore

Explanation

Ransomware commonly targets reachable backups, so a copy must be isolated from production credentials and networks, ideally immutable or offline, to remain recoverable. Physical or logical separation is what preserves the recovery capability during an attack.

Question 34Business Continuity and Disaster Recovery

A DR plan documents an RTO of four hours for an inventory system, but the last exercise showed restoration consistently taking six hours. What does this indicate about the plan?

  1. The system should be removed from the DR plan scope
  2. The recovery capability does not meet the documented objective and requires remediation Correct answer.
  3. The RTO is too conservative and should be raised to six hours
  4. The exercise methodology was invalid because it measured actual time

Explanation

When measured recovery time exceeds the RTO, the gap must be closed through additional investment, process improvement, or architecture change, because the RTO reflects business tolerance rather than current capability. Raising the RTO to match poor performance simply hides the shortfall from the business.

Question 35Business Continuity and Disaster Recovery

Which strategy most directly reduces the time needed to recover a virtualized environment after loss of the primary data center?

  1. Increasing the frequency of full backups to tape
  2. Storing configuration documentation in the primary data center
  3. Maintaining replicated virtual machines at a secondary site that can be powered on Correct answer.
  4. Documenting manual rebuild procedures for each server

Explanation

Replicating virtual machines to a secondary site allows them to be started with minimal rebuild effort, directly shortening recovery time. Backup frequency affects data loss rather than restoration speed, and manual rebuilds are the slowest option.

Question 36Business Continuity and Disaster Recovery

Which arrangement best ensures that a DR plan remains usable when key staff are unavailable during an incident?

  1. Keeping the plan in a single printed copy in the data center
  2. Restricting plan access to the IT director for confidentiality
  3. Relying on vendor engineers to reconstruct procedures during the event
  4. Documenting procedures with role-based responsibilities and cross-training backups for each critical role Correct answer.

Explanation

Plans should assign responsibilities to roles rather than named individuals and ensure trained alternates exist, so recovery does not depend on specific people being reachable. This also supports succession during prolonged incidents.

Question 37Business Continuity and Disaster Recovery

An organization's DR plan requires a validated offline copy of backups. Which practice best demonstrates that this requirement is met?

  1. Counting the number of backup jobs completed per week
  2. Performing a periodic restore of the offline copy into an isolated environment and verifying data integrity Correct answer.
  3. Reviewing the backup job success logs from the last quarter
  4. Confirming that the offline media are stored in a locked cabinet

Explanation

Only an actual restore into an isolated environment proves that the offline copy is usable and complete, because success logs and storage controls do not verify recoverability. Isolating the test protects production from any corrupted or infected data.

Question 38Business Continuity and Disaster Recovery

Which document typically records the order in which applications must be brought back online to respect their interdependencies?

  1. The asset inventory
  2. The recovery sequence or dependency matrix Correct answer.
  3. The change management log
  4. The service catalog

Explanation

A recovery sequence or dependency matrix captures which systems must be restored before others, based on data flows and service dependencies. Following it prevents bringing up an application that cannot function without a downstream or upstream system.

Question 39Business Continuity and Disaster Recovery

A critical application depends on a directory service that is not included in the DR plan scope. What is the most significant risk this creates?

  1. Authentication failures may prevent the application from being usable even if it is restored Correct answer.
  2. The application's RPO will automatically double
  3. The application's backup window may extend beyond the maintenance period
  4. The application's licensing costs may increase

Explanation

Recovery scope must include supporting dependencies such as directory services, DNS, and identity providers, because an application restored without them cannot authenticate users or resolve services. Dependency analysis during planning is how such gaps are found before an incident.

Question 40Business Continuity and Disaster Recovery

Which test type validates recovery procedures by having staff walk through the plan in a facilitated discussion without activating systems or relocating?

  1. Simulation test
  2. Full interruption test
  3. Parallel test
  4. Tabletop exercise Correct answer.

Explanation

A tabletop exercise gathers participants to discuss roles, decisions, and plan steps against a scenario without touching production or alternate systems. It is low risk and effective for surfacing assumptions and communication gaps before more disruptive tests.

Question 41Business Continuity and Disaster Recovery

An organization needs to decide whether to invest in a hot site or accept longer outages. Which input from the BIA most directly supports this decision?

  1. The average age of the server fleet
  2. The number of open change requests
  3. The time-based financial and operational impact of outages for critical functions Correct answer.
  4. The number of applications in the portfolio

Explanation

The BIA's time-based impact curve shows how losses accumulate as an outage lengthens, which can be compared against the cost of a hot site. This cost-of-downtime versus cost-of-readiness comparison is the basis for selecting a recovery strategy.

Question 42Business Continuity and Disaster Recovery

Which practice best protects the integrity of a DR plan between reviews?

  1. Freezing the plan document so it cannot be edited
  2. Storing the plan only in a shared drive accessible to all staff
  3. Applying version control with defined review triggers such as major changes and post-exercise findings Correct answer.
  4. Allowing each team to maintain its own unreconciled copy

Explanation

Version control with explicit review triggers keeps the plan current and traceable, ensuring changes to infrastructure and lessons from exercises are reflected. Uncontrolled copies create inconsistency that surfaces as confusion during a real event.

Question 43Business Continuity and Disaster Recovery

A business unit's recovery time objective is two hours, but its supporting system has an RTO of eight hours. What does this discrepancy represent?

  1. An acceptable design because business and IT objectives need not align
  2. A documentation error with no operational consequence
  3. A recovery gap where the supporting system cannot meet the business requirement Correct answer.
  4. Evidence that the business RTO should be extended to eight hours

Explanation

Supporting system RTOs must be equal to or shorter than the business function's RTO, otherwise the function cannot resume within its tolerance. The discrepancy is a gap requiring architecture change, additional investment, or an explicit business decision to accept the risk.

Question 44Business Continuity and Disaster Recovery

Which control most effectively limits the spread of a ransomware infection from production systems to the backup infrastructure?

  1. Enabling compression and deduplication on the backup repository
  2. Segmenting the backup network and using dedicated, least-privilege credentials for backup operations Correct answer.
  3. Using the same domain administrator account for backup jobs and production administration
  4. Increasing the frequency of incremental backups

Explanation

Network segmentation and dedicated least-privilege credentials prevent an attacker in production from reaching backup systems and using stolen privileged accounts. These controls directly reduce the blast radius that ransomware can achieve.

Question 45Business Continuity and Disaster Recovery

An organization must demonstrate to auditors that its DR capability is effective. Which evidence most strongly supports that assertion?

  1. Purchase orders for alternate site capacity
  2. Results of a recent exercise showing recovery within documented objectives, with issues tracked to closure Correct answer.
  3. A signed policy stating that DR testing occurs annually
  4. A list of all staff who have read the plan

Explanation

Auditors look for evidence that recovery objectives were actually met in a test and that identified deficiencies were remediated and tracked. Policy statements and reading records show intent and awareness but not operational effectiveness.

Question 46Business Continuity and Disaster Recovery

An application's database is replicated asynchronously to a secondary region with an average lag of 15 minutes. The business has set an RPO of 5 minutes. What is the most accurate assessment?

  1. The design cannot reliably meet the RPO and requires synchronous or more frequent replication Correct answer.
  2. The RPO is irrelevant because replication is asynchronous
  3. The design exceeds the RPO because 15 minutes is longer than 5 minutes
  4. The design satisfies the RPO because replication exists

Explanation

Asynchronous replication with a 15-minute lag can lose up to roughly 15 minutes of transactions, which exceeds a 5-minute RPO. Meeting the objective requires reducing lag through synchronous replication, more frequent log shipping, or a revised business requirement.

Question 47Business Continuity and Disaster Recovery

An organization depends on a single cloud region for production and its backups, and a regional outage is identified as a credible threat. Which change most directly addresses this single point of failure?

  1. Replicating backups and critical workloads to a second region with independent credentials Correct answer.
  2. Adding more compute capacity in the primary region
  3. Enabling versioning on the primary region's storage buckets
  4. Increasing backup retention from 30 to 90 days

Explanation

A regional outage defeats any protection confined to that region, so recovery capability requires copies and workloads in an independent region. Independent credentials also prevent a compromise of the primary account from affecting the secondary copy.

Question 48Business Continuity and Disaster Recovery

Two systems share a database. System A has an RTO of two hours and System B has an RTO of eight hours, but B's writes are required for A to process transactions. What is the correct planning conclusion?

  1. System A should be removed from the DR plan because of the dependency
  2. The shared database must be recovered within two hours to satisfy A's dependency Correct answer.
  3. The shared database can be restored on B's eight-hour schedule because A's RTO is shorter
  4. The RTOs should be averaged to five hours for the shared database

Explanation

Recovery sequencing must satisfy the most demanding dependent system, so a shared component inherits the shortest RTO among the systems that require it. Restoring the database on B's schedule would leave A unable to function within its two-hour objective.

Question 49Business Continuity and Disaster Recovery

A DR strategy relies on restoring from backup at a warm site. Analysis shows the restore of the full dataset takes longer than the documented RTO even before application configuration begins. Which remediation best closes the gap?

  1. Pre-staging replicated data or continuously shipping changes to the warm site so restoration time shrinks Correct answer.
  2. Documenting the restore procedure in greater detail
  3. Shortening the backup retention period
  4. Adding more staff to the recovery team to work in parallel

Explanation

When restore duration alone exceeds the RTO, the strategy must change so data is already present or nearly current at the recovery site, such as through replication or continuous log shipping. Process documentation and staffing cannot compress the fundamental time required to move a large dataset.

Question 50Business Continuity and Disaster Recovery

A post-exercise review finds that recovery succeeded but the incident commander made several decisions outside documented authority. Which corrective action addresses the root cause most effectively?

  1. Adding more technical detail to the recovery runbooks
  2. Clarifying and documenting decision authority and escalation thresholds, then validating them in the next exercise Correct answer.
  3. Shortening the exercise scenario to reduce decision points
  4. Removing the incident commander from future exercises

Explanation

Decisions made outside documented authority usually indicate that the plan's authority matrix or escalation thresholds are ambiguous or impractical. Clarifying them and validating the change in a subsequent exercise fixes the underlying governance gap rather than blaming an individual.