I85PREP
⌘ K
PECB Certified Lead Disaster Recovery Manager study materials
PECB Certified Lead Disaster Recovery Manager study resources

PECB Certified Lead Disaster Recovery Manager practice questions

One question at a time. Build your PECB Certified Lead Disaster Recovery Manager understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Disaster recovery concepts and principles

In disaster recovery planning, what does the recovery time objective (RTO) define?

  1. The maximum acceptable time to restore a service after a disruption Correct answer.
  2. The frequency at which backups must be tested
  3. The total cost of ownership for the recovery site
  4. The maximum acceptable amount of data loss measured in time

Explanation

RTO is the target duration within which a business process or IT service must be restored after a disruption to avoid unacceptable consequences. It sets the deadline for recovery, not the tolerable data loss, which is the recovery point objective (RPO).

Question 2Disaster recovery concepts and principles

A business impact analysis (BIA) identifies a maximum tolerable downtime (MTD) of 12 hours for a payment service. Which statement correctly relates MTD to RTO?

  1. RTO must be equal to MTD to guarantee zero data loss
  2. RTO and MTD are unrelated metrics used by different departments
  3. RTO may exceed MTD because MTD applies only to data loss
  4. RTO should be set shorter than MTD to leave time for validation and stakeholder communication Correct answer.

Explanation

The MTD is the longest time a process can be unavailable before unacceptable harm occurs. RTO is the target restoration time and should be set below MTD so that recovery, testing, and communication complete before the MTD is breached.

Question 3Disaster recovery concepts and principles

Which document defines the step-by-step actions, responsibilities, and resources required to recover IT systems after a disaster?

  1. Business continuity policy
  2. Risk register
  3. Service level agreement
  4. Disaster recovery plan Correct answer.

Explanation

The disaster recovery plan (DRP) is the operational document that details how IT infrastructure and services will be restored, including procedures, roles, and resource requirements. A business continuity policy sets direction, while a risk register and SLA serve different purposes.

Question 4Disaster recovery concepts and principles

Which recovery strategy typically provides the shortest RTO but at the highest ongoing cost?

  1. Hot site Correct answer.
  2. Backup and restore to original site
  3. Warm site
  4. Cold site

Explanation

A hot site is a fully equipped alternate facility with replicated data and ready-to-run systems, enabling rapid recovery and therefore the shortest RTO. The trade-off is high recurring cost for maintaining the site and synchronization.

Question 5Disaster recovery concepts and principles

An organization replicates data asynchronously to a secondary region. What is the primary implication for the recovery point objective (RPO)?

  1. RPO is effectively zero because replication is continuous
  2. RPO is determined solely by the backup schedule
  3. RPO is equal to the recovery time objective
  4. RPO depends on the replication lag and may be greater than zero Correct answer.

Explanation

Asynchronous replication does not wait for the secondary site to acknowledge each write, so some recent data may not have been transferred when a disaster occurs. The achievable RPO is therefore bounded by the replication lag, not zero.

Question 6Disaster recovery concepts and principles

What is the main purpose of conducting a disaster recovery test?

  1. To satisfy insurance requirements without changing the plan
  2. To replace the need for a business impact analysis
  3. To validate that recovery procedures, resources, and roles work as documented Correct answer.
  4. To demonstrate that a disaster will never occur

Explanation

DR testing verifies the plan's viability by exercising procedures, confirming resource availability, and revealing gaps in roles or documentation. It is a validation activity, not a compliance formality or a substitute for analysis.

Question 7Disaster recovery concepts and principles

Which type of DR test involves relocating operations to the alternate site and running business processes for a defined period?

  1. Full failover test Correct answer.
  2. Checklist review
  3. Tabletop exercise
  4. Walkthrough

Explanation

A full failover test activates the alternate site and runs actual business or IT operations there for a period, providing the highest fidelity. Tabletop exercises and walkthroughs are discussion-based and do not relocate operations.

Question 8Disaster recovery concepts and principles

In DR planning, what does the term 'dependency mapping' primarily identify?

  1. The reporting lines in the organizational chart
  2. The financial dependencies between business units
  3. The contractual dependencies on external auditors
  4. The technical and process relationships between systems, applications, and infrastructure Correct answer.

Explanation

Dependency mapping documents how systems, applications, data, and infrastructure rely on one another so that recovery order and scope are correct. It focuses on operational and technical relationships rather than financial or organizational structures.

Question 9Disaster recovery concepts and principles

Which statement best describes the relationship between business continuity (BC) and disaster recovery (DR)?

  1. BC focuses on IT restoration, while DR focuses on business processes
  2. DR is a subset of BC focused on restoring IT and supporting infrastructure Correct answer.
  3. BC and DR are identical and interchangeable terms
  4. DR is broader than BC and includes all business functions

Explanation

Business continuity addresses the organization's ability to continue critical business functions during and after disruption, while disaster recovery is the IT-focused component that restores technology and infrastructure. DR therefore sits within the broader BC discipline.

Question 10Disaster recovery concepts and principles

What is the primary role of a disaster recovery manager during an actual disaster declaration?

  1. To coordinate the recovery effort, communicate with stakeholders, and authorize plan activation Correct answer.
  2. To personally restore all servers to reduce delay
  3. To revise the BIA with new figures before recovery begins
  4. To negotiate new vendor contracts for future resilience

Explanation

The DR manager leads and coordinates the response, ensures the plan is activated appropriately, and manages communication among teams and stakeholders. Hands-on restoration is delegated to technical teams, and post-event analysis occurs after stabilization.

Question 11Disaster recovery concepts and principles

A recovery strategy uses a pilot light approach. Which characteristic distinguishes it from a warm standby?

  1. The pilot light keeps only core services running in the cloud and scales up on failover Correct answer.
  2. The pilot light maintains a fully scaled duplicate environment at all times
  3. The pilot light has no data replication to the recovery site
  4. The pilot light requires manual rebuilding of all servers from bare metal

Explanation

In a pilot light strategy, a minimal core environment (such as data replication and essential services) is always running, and additional components are provisioned or scaled during failover. A warm standby maintains a more complete, scaled environment ready to take over.

Question 12Disaster recovery concepts and principles

What is the purpose of a recovery point objective (RPO) in backup design?

  1. To determine the number of backup copies required
  2. To set the retention period for archived tapes
  3. To define the maximum time to restore the backup
  4. To specify the maximum acceptable data loss measured in time Correct answer.

Explanation

RPO defines how much data, expressed as a time interval, the organization can afford to lose. Backup frequency and replication design are then chosen so that the interval between recovery points does not exceed the RPO.

Question 13Disaster recovery concepts and principles

An organization's DR plan requires that the recovery site be at least 50 kilometers from the primary site. Which risk is this requirement primarily intended to mitigate?

  1. A regional disaster affecting both sites simultaneously Correct answer.
  2. Unauthorized access to the recovery site
  3. Network latency between sites
  4. Insufficient bandwidth for replication

Explanation

Geographic separation reduces the likelihood that a single regional event, such as an earthquake, flood, or extended power outage, disables both primary and recovery sites. Latency, access control, and bandwidth are separate design considerations.

Question 14Disaster recovery concepts and principles

Which metric represents the maximum time a business process can be unavailable before its failure causes unacceptable harm?

  1. Maximum tolerable downtime (MTD) Correct answer.
  2. Recovery time objective (RTO)
  3. Recovery point objective (RPO)
  4. Mean time to repair (MTTR)

Explanation

The maximum tolerable downtime (MTD) is the longest period a process can be down before the impact becomes unacceptable to the organization. RTO is the target restoration time set within the MTD, and RPO concerns data loss.

Question 15Disaster recovery concepts and principles

What is the primary benefit of maintaining a manual workaround procedure in a DR plan?

  1. It allows critical functions to continue when automated systems are unavailable Correct answer.
  2. It reduces the RPO to zero
  3. It eliminates the need for a recovery site
  4. It replaces the need for testing

Explanation

Manual workarounds provide a documented way to perform critical activities when automated systems are down, bridging the gap until restoration. They do not remove the need for recovery sites or testing, nor do they change data-loss objectives.

Question 16Disaster recovery concepts and principles

Which of the following is a leading indicator that a DR program is maturing?

  1. The plan document has not changed in three years
  2. Recovery responsibilities are assigned to a single individual
  3. Test findings are tracked to closure and drive plan updates Correct answer.
  4. The DR budget is the smallest in the IT portfolio

Explanation

A mature DR program uses test results to identify gaps and tracks corrective actions through to closure, feeding continuous improvement. A static plan, minimal budget, or single-person dependency are signs of weakness, not maturity.

Question 17Disaster recovery concepts and principles

What does a 'warm site' typically provide?

  1. A mobile trailer that can be deployed anywhere
  2. A fully configured duplicate of the primary data center
  3. Space and power only, with no equipment installed
  4. Partially equipped infrastructure that requires additional configuration before use Correct answer.

Explanation

A warm site includes some hardware, connectivity, and possibly partial data replication, but additional configuration and data restoration are needed before it can run production. This gives a moderate RTO and cost between cold and hot sites.

Question 18Disaster recovery concepts and principles

During a tabletop exercise, participants discover that the DR plan lists a contact who left the company a year ago. What is the most appropriate next step?

  1. Delay plan updates until the next annual review
  2. Remove the contact's name and leave the field blank
  3. Ignore the finding because the exercise is not a real event
  4. Update the contact list and assign an owner to maintain it Correct answer.

Explanation

Exercise findings should be logged and corrected promptly, with clear ownership, so the plan remains usable. Updating the contact list and assigning maintenance responsibility addresses the root cause and prevents recurrence.

Question 19Disaster recovery concepts and principles

Which statement correctly describes the role of the recovery point objective (RPO) in selecting a backup strategy?

  1. RPO is irrelevant when using cloud storage
  2. A shorter RPO generally requires more frequent backups or continuous replication Correct answer.
  3. RPO determines the recovery site's physical distance
  4. A longer RPO requires more frequent backups

Explanation

A shorter RPO means less tolerable data loss, which drives more frequent backup intervals or continuous replication. A longer RPO permits less frequent data protection and lower cost.

Question 20Disaster recovery concepts and principles

What is the purpose of a business impact analysis (BIA) in the DR context?

  1. To select the backup software vendor
  2. To document the network topology
  3. To test the technical recovery procedures
  4. To identify critical business functions and quantify the impact of their disruption Correct answer.

Explanation

The BIA identifies critical business processes, their dependencies, and the financial and operational impact of disruption over time. Its outputs, such as MTD and RTO, drive the DR strategy and priorities.

Question 21Disaster recovery concepts and principles

An organization uses a cold site as its only recovery strategy. Which limitation should the DR manager communicate to executive management?

  1. The cold site cannot be used for any DR testing
  2. The cold site automatically replicates data from the primary site
  3. The cold site provides no physical space for recovery
  4. The cold site requires substantial time to install and configure equipment, extending the RTO Correct answer.

Explanation

A cold site offers space and basic utilities but no pre-installed IT equipment, so hardware must be procured, installed, and configured before recovery can begin. This typically produces a long RTO that may exceed business tolerances.

Question 22Disaster recovery concepts and principles

Which element is essential in a disaster recovery plan's communication section?

  1. The marketing strategy for the coming year
  2. Escalation paths and contact details for internal and external stakeholders Correct answer.
  3. The full text of the organization's code of conduct
  4. A list of all employees' home addresses

Explanation

The communication section must define who is notified, in what order, and through which channels, including internal teams, management, customers, and regulators. Escalation paths and current contact details are essential for timely activation and coordination.

Question 23Disaster recovery concepts and principles

What distinguishes a disaster declaration from a routine incident escalation?

  1. A declaration is always made by the IT service desk
  2. A declaration invokes the formal DR plan and associated authorities and resources Correct answer.
  3. A declaration is made only after the primary site is permanently lost
  4. A declaration eliminates the need for post-incident review

Explanation

A disaster declaration is a formal decision that activates the DR plan, assigns authority, and releases dedicated resources. It is based on predefined criteria and is distinct from normal incident management escalation.

Question 24Disaster recovery concepts and principles

An organization wants to reduce its RTO without increasing capital expenditure on a secondary data center. Which approach is most aligned with this goal?

  1. Replace the hot site with a cold site
  2. Eliminate DR testing to free up staff time
  3. Adopt cloud-based infrastructure as code to provision recovery environments on demand Correct answer.
  4. Reduce backup frequency to lower storage costs

Explanation

Infrastructure as code in the cloud allows recovery environments to be provisioned rapidly and consistently without maintaining a full secondary data center, improving RTO while controlling capital cost. Reducing backups or testing would degrade recovery capability.

Question 25Disaster recovery concepts and principles

Which of the following best describes the concept of 'defense in depth' as applied to disaster recovery?

  1. Layering preventive, detective, and corrective controls to reduce the likelihood and impact of disruption Correct answer.
  2. Relying on a single, highly resilient recovery site
  3. Documenting recovery procedures in a single master document
  4. Outsourcing all recovery responsibilities to a third party

Explanation

Defense in depth combines multiple independent controls, such as redundancy, monitoring, backups, and tested procedures, so that no single failure defeats recovery. It reduces both the probability and the severity of disruptions.

Question 26Disaster recovery concepts and principles

Which statement best defines a disaster for the purposes of disaster recovery management?

  1. A scheduled maintenance activity that temporarily reduces capacity in a production data center
  2. A security patch that must be applied to all endpoints within a defined compliance window
  3. An event that exceeds the organization's ability to recover using normal operational resources and therefore requires invocation of the DR plan Correct answer.
  4. Any unplanned outage of a single server that is restored by the on-call engineer within the service window

Explanation

In DR management a disaster is defined by its impact relative to normal recovery capability, not by the size of the incident itself. When routine operational resources and procedures can no longer restore service within acceptable limits, the event escalates to a disaster and the DR plan is invoked. This threshold-based definition is what allows a DR manager to justify declaration decisions consistently.

Question 27Disaster recovery concepts and principles

A DR manager is choosing between several recovery strategies. Which criterion should drive the choice most directly?

  1. The physical age of the equipment in the primary data center
  2. The number of vendors currently under contract for hardware support
  3. The recovery time and recovery point objectives derived from the business impact analysis Correct answer.
  4. The preference of the IT operations team for familiar tooling

Explanation

Recovery strategies exist to satisfy the RTO and RPO targets that the BIA establishes for each business process. Selecting a strategy before those targets are known risks either over-investing or accepting unacceptable downtime and data loss. Vendor contracts, equipment age, and team preference are secondary considerations that should be evaluated against the objectives, not instead of them.

Question 28Disaster recovery concepts and principles

What distinguishes a reciprocal agreement from other alternate site arrangements?

  1. It relies on another organization providing capacity under a mutual, usually informal, arrangement Correct answer.
  2. It guarantees a fully equipped hot site at no cost to either party
  3. It provides only raw floor space and power with no environmental controls
  4. It requires the two organizations to be owned by the same parent company

Explanation

A reciprocal agreement is a mutual arrangement in which two organizations agree to host each other's operations during a disruption. Such agreements are typically informal, untested, and risky because both parties may be affected by the same regional event and capacity is not contractually guaranteed. A cold site, by contrast, is a commercial arrangement providing basic space and infrastructure.

Question 29Disaster recovery concepts and principles

An organization is classifying the severity of an incident. Which factor most appropriately triggers a formal disaster declaration?

  1. The affected system is owned by a team outside the IT department
  2. The incident has been reported in the media before an internal root cause is known
  3. The estimated recovery time with normal resources exceeds the tolerance defined in the DR plan Correct answer.
  4. The incident has lasted longer than the current shift of the service desk

Explanation

Disaster declaration criteria should be pre-defined and tied to whether normal recovery can meet the business tolerance for downtime. Comparing the projected recovery duration against that threshold gives an objective, auditable basis for declaring. Media attention and organizational boundaries may influence communications but are not the substantive trigger.

Question 30Disaster recovery concepts and principles

Which term describes the practice of maintaining redundant components so that a single failure does not interrupt service?

  1. Capacity planning
  2. Change enablement
  3. Fault tolerance Correct answer.
  4. Segregation of duties

Explanation

Fault tolerance is the property of a system that continues operating correctly when a component fails, typically through redundancy such as mirrored disks or clustered nodes. It differs from recovery, which restores service after interruption. Segregation of duties, capacity planning, and change enablement address control, sizing, and change risk rather than continuity of operation under failure.

Question 31Disaster recovery concepts and principles

A DR manager is reviewing how the plan addresses people. Which consideration belongs in the DR scope rather than in general HR policy?

  1. Performance appraisal cycles for IT personnel
  2. Alternate staffing and remote work arrangements for recovery teams during an outage Correct answer.
  3. Annual leave accrual rules for permanent staff
  4. Payroll deduction schedules for the finance department

Explanation

DR planning must address how recovery personnel will be available, contacted, and supported when normal workplaces are inaccessible. That includes alternate staffing, remote working arrangements, and welfare provisions for extended response. Leave accrual, payroll deductions, and appraisal cycles are standard HR administration and do not belong in DR scope.

Question 32Disaster recovery concepts and principles

Which statement correctly distinguishes a crisis from an emergency in DR terminology?

  1. A crisis is always shorter in duration than an emergency
  2. An emergency always requires external regulatory notification
  3. A crisis is confined to IT systems while an emergency affects facilities
  4. A crisis implies a threat to the organization's viability or reputation that demands strategic decisions Correct answer.

Explanation

In continuity and DR practice an emergency is a disruptive event that can be managed with established operational response, while a crisis threatens the organization's strategic position, viability, or reputation and requires senior leadership decisions. Duration and notification obligations do not define the distinction. The classification guides who leads the response and what governance applies.

Question 33Disaster recovery concepts and principles

What is the primary purpose of defining a recovery time objective for each critical business process?

  1. To record the exact clock time at which the last backup completed
  2. To set the frequency of DR awareness training for employees
  3. To determine the number of staff required at the alternate site
  4. To specify the acceptable elapsed time for restoring the process after disruption Correct answer.

Explanation

The RTO expresses how long a process may remain unavailable before the impact becomes unacceptable, and it drives strategy selection and test criteria. It is distinct from the RPO, which concerns tolerable data loss. Staffing levels and training frequency are downstream planning decisions informed by, but not equivalent to, the RTO.

Question 34Disaster recovery concepts and principles

A DR manager finds that the documented DR plan has not been updated since a major platform migration. What is the most significant consequence for recovery capability?

  1. The plan will fail a documentation formatting audit
  2. The plan will automatically trigger a disaster declaration
  3. Recovery steps will reference decommissioned systems and miss new dependencies, extending the actual recovery time Correct answer.
  4. Backup retention periods will be shortened without approval

Explanation

A DR plan is only as good as its alignment with the current environment. After a migration, outdated runbooks reference retired components and omit new interdependencies, so responders lose time diagnosing and improvising, which erodes the achievable RTO. Formatting and retention are separate governance concerns, and an outdated plan does not itself cause declarations.

Question 35Disaster recovery concepts and principles

Which principle explains why DR arrangements should be documented, tested, and reviewed rather than relying on individual expertise?

  1. Data minimization
  2. Separation of environments
  3. Least privilege access
  4. Knowledge continuity and organizational resilience Correct answer.

Explanation

Recovery capability that resides only in the memory of specific individuals is fragile, because those people may be unavailable during the very event being planned for. Documented, tested, and reviewed arrangements preserve institutional knowledge and make recovery repeatable regardless of who is present. Least privilege, data minimization, and environment separation address security and change control rather than continuity of know-how.

Question 36Disaster recovery concepts and principles

An organization's DR strategy depends entirely on a single cloud region. Which risk should the DR manager highlight?

  1. A regional outage would affect both primary and recovery environments simultaneously Correct answer.
  2. The provider may change its pricing model at renewal
  3. Cloud backups may be encrypted at rest
  4. The provider's certification may lapse

Explanation

Concentration risk arises when primary and recovery capabilities share a common failure domain. If both sit in the same cloud region, a region-wide event removes the recovery capability along with production, defeating the purpose of the strategy. Geographic separation of recovery resources is the standard mitigation.

Question 37Disaster recovery concepts and principles

What does the term 'maximum tolerable downtime' represent in DR planning?

  1. The longest backup job duration permitted by the storage team
  2. The longest outage the organization can absorb before unacceptable consequences arise Correct answer.
  3. The longest test window the DR team can schedule each year
  4. The maximum number of servers that may fail in one incident

Explanation

Maximum tolerable downtime is the business-derived limit on how long a process or function may be unavailable before the impact becomes intolerable. Recovery objectives are then set at or inside that limit. It is not a testing, failure-count, or backup-performance parameter, although those may be constrained by it.

Question 38Disaster recovery concepts and principles

A DR manager is evaluating whether to adopt a fully mirrored active-active architecture. Which trade-off should be presented to leadership?

  1. It nearly removes failover time but requires substantial ongoing cost and operational complexity Correct answer.
  2. It removes all residual risk from the environment
  3. It guarantees compliance with every regulatory requirement
  4. It eliminates the need for a business impact analysis

Explanation

Active-active designs can bring recovery time close to zero, but they demand duplicate infrastructure, sophisticated data consistency handling, and mature operations. Leadership should weigh that investment against the business value of near-zero downtime. No architecture eliminates residual risk, and the BIA remains necessary to justify the target.

Question 39Disaster recovery concepts and principles

Which concept describes restoring service at reduced capacity while critical functions are recovered first?

  1. Full cutover
  2. Data replication
  3. Parallel processing
  4. Phased recovery Correct answer.

Explanation

Phased recovery brings back prioritized functions in stages, often at reduced capacity, so the most time-sensitive processes resume earliest. It aligns recovery sequencing with the priorities identified in the BIA. Full cutover restores everything at once, while parallel processing and replication are technical mechanisms rather than recovery sequencing concepts.

Question 40Disaster recovery concepts and principles

Which statement best explains why DR objectives should be traceable to business impact analysis results?

  1. It demonstrates that recovery investment is proportionate to the business consequences of disruption Correct answer.
  2. It transfers accountability for recovery from business owners to IT
  3. It removes the need to test recovery arrangements
  4. It allows the DR budget to be allocated strictly by department headcount

Explanation

Traceability links each recovery target and investment to a documented business consequence, which supports justification, prioritization, and audit. It shows that spending and effort are proportionate to impact rather than arbitrary. It does not remove testing obligations, and accountability for business processes stays with business owners.

Question 41Disaster recovery program initiation and governance

Within a disaster recovery (DR) program, which document formally authorizes the program, names its sponsor, and defines its scope and mandate before detailed planning begins?

  1. The recovery runbook library
  2. The business impact analysis report
  3. The DR program charter Correct answer.
  4. The annual DR test schedule

Explanation

The DR program charter is the initiating governance artifact: it establishes authority, identifies the executive sponsor, and bounds the program's scope so subsequent activities such as the BIA and planning have a sanctioned mandate. The other artifacts are downstream deliverables produced once the program is authorized.

Question 42Disaster recovery program initiation and governance

A newly appointed DR manager must secure executive backing before committing budget. Which action best demonstrates that top management is exercising its governance role over the DR program?

  1. Delegating all DR decisions to the IT operations team without oversight
  2. Approving the DR policy and assigning accountability for recovery outcomes Correct answer.
  3. Reviewing recovery runbooks line by line during incident response
  4. Purchasing backup software before defining any recovery requirements

Explanation

Governance requires top management to set direction and assign accountability, which is expressed through approving the DR policy and designating who owns recovery outcomes. Hands-on runbook review or premature purchasing are operational actions that do not constitute governance direction.

Question 43Disaster recovery program initiation and governance

Which statement best describes the purpose of a DR policy within program initiation?

  1. It states management's intent, principles, and mandatory requirements for disaster recovery Correct answer.
  2. It specifies the vendor contract terms for the alternate recovery site
  3. It lists the technical steps to fail over each individual application server
  4. It records the results of the most recent recovery exercise

Explanation

A policy is a high-level statement of management intent that establishes principles and mandatory requirements, providing the authority from which plans and procedures derive. Step-level failover instructions, test results, and vendor terms belong to procedures, reports, and contracts respectively.

Question 44Disaster recovery program initiation and governance

During program initiation, a DR manager is defining the governance structure. Which element is essential for ensuring DR decisions are made and enforced across the organization?

  1. A shared drive where anyone may edit recovery documents at will
  2. An informal agreement that teams will cooperate when an incident occurs
  3. A single technician who personally handles all recovery tasks
  4. A defined decision-making body with clear roles, authority, and escalation paths Correct answer.

Explanation

Effective governance depends on a defined body with explicit roles, decision authority, and escalation routes so that recovery decisions are made consistently and enforced. Relying on one individual, informal cooperation, or uncontrolled document editing leaves accountability and enforcement undefined.

Question 45Disaster recovery program initiation and governance

A DR manager is scoping the program and must decide which organizational units fall within its boundary. Which approach best reflects sound program scoping at initiation?

  1. Include only units whose managers volunteered to participate
  2. Define scope based on critical business processes and their dependencies across units Correct answer.
  3. Set scope to whatever the available budget can cover this year
  4. Limit scope to the data center that houses the largest mainframe

Explanation

Scope should be anchored to the critical business processes and their interdependencies, because recovery obligations follow business impact rather than physical location or voluntary participation. A budget-constrained or location-limited scope risks excluding essential dependencies and leaving recovery gaps.

Question 46Disaster recovery program initiation and governance

Which individual is typically accountable for ensuring the DR program aligns with organizational objectives and receives adequate resources?

  1. The help desk shift supervisor
  2. The junior analyst who updates the contact list
  3. The external backup media courier
  4. The executive sponsor of the DR program Correct answer.

Explanation

The executive sponsor provides top-management commitment, aligns the program with organizational objectives, and secures resources. The other roles are operational or support functions that carry no program-level accountability for resources and alignment.

Question 47Disaster recovery program initiation and governance

A DR manager wants to formalize how the program will measure success and report progress to leadership. Which governance instrument is most appropriate to establish these measures at initiation?

  1. Program objectives and key performance indicators approved by the sponsor Correct answer.
  2. A list of every server in the environment
  3. A draft press release for a future outage
  4. The previous year's incident tickets

Explanation

Establishing objectives and key performance indicators approved by the sponsor gives the program measurable targets and a basis for reporting progress to leadership. Inventories, historical tickets, and draft communications are inputs or artifacts but do not define success measures.

Question 48Disaster recovery program initiation and governance

Which of the following best characterizes the relationship between the DR program and the broader business continuity management system?

  1. DR is only concerned with physical facility security
  2. DR is entirely unrelated to continuity management and operates in isolation
  3. DR is a component of continuity management focused on restoring technology and infrastructure Correct answer.
  4. DR replaces continuity management by covering all business functions

Explanation

Disaster recovery is a discipline within business continuity management that concentrates on restoring technology and supporting infrastructure, while continuity management addresses the broader spectrum of business functions. Treating DR as isolated, as a replacement, or as purely physical security misrepresents this relationship.

Question 49Disaster recovery program initiation and governance

At program initiation, a DR manager must identify applicable legal, regulatory, and contractual obligations. Why is this activity important to governance?

  1. It guarantees that no future regulation will ever affect the program
  2. It allows the program to ignore internal risk appetite statements
  3. It removes the need to perform a business impact analysis
  4. It establishes mandatory recovery requirements and compliance boundaries the program must satisfy Correct answer.

Explanation

Identifying legal, regulatory, and contractual obligations defines the mandatory requirements and compliance boundaries within which the DR program must operate. This does not eliminate the need for a BIA, cannot insulate against future regulation, and does not override internal risk appetite.

Question 50Disaster recovery program initiation and governance

A DR steering committee is being formed. Which membership composition best supports effective program governance?

  1. A rotating group of volunteers with no defined roles
  2. Only external consultants with no internal decision authority
  3. Cross-functional leaders representing business, IT, risk, and compliance with authority to decide Correct answer.
  4. Only members of the network engineering team

Explanation

Effective DR governance requires cross-functional representation from business, technology, risk, and compliance, with members empowered to make decisions. Single-discipline, externally led, or role-less volunteer groups cannot balance business priorities against technical and compliance constraints.