Module 10 - Disaster Recovery Answer Key Part 4

: Module 10 - Disaster Recovery 88. What are the seven steps that are recommended for developing a comprehensive disaster recovery plan? ANSWER: 1. Develop the DR planning policy statement: A formal department or agency policy provides the authority and guidance necessary to develop an effective contingency plan. 2. Review the business impact analysis (BIA): The BIA was prepared to help identify and prioritize critical IT systems and components. A review of what was discovered is an important step in the process. 3. Identify preventive controls: Measures taken to reduce the effects of system disruptions can increase system availability and reduce contingency life-cycle costs. 4. Create DR contingency strategies: Thorough recovery strategies ensure that the system may be recovered quickly and effectively following a disruption. 5. Develop the DR plan: The DR plan should contain detailed guidance and procedures for restoring the organization and its system after a disaster. 6. Ensure DR plan testing, training, and exercises: Testing validates recovery capabilities, training prepares recovery personnel for plan activation, and exercises identify planning gaps; together, these activities improve plan effectiveness and overall organizational preparedness. 7. Ensure DR plan maintenance: The DR plan should be a living document that is updated regularly to remain current with system enhancements and organizational changes. : Module 10 - Disaster Recovery 89. What is involved in training for a DR plan? ANSWER: Training for a DR plan consists of: 1. Making employees aware of the need for a disaster recovery plan 2. Informing all employees of the existence of the plan and providing procedures to follow in the event of an emergency 3. Training all personnel who have responsibilities identified in the plan to perform the disaster recovery procedures 4. Providing the opportunity for recovery teams to practice disaster recovery skills 90. Contrary to popular belief, DR strategies go substantially beyond the recovery portion of data backup and recovery. Discuss what further steps are necessary. DR strategies go substantially beyond the recovery portion of data backup and ANSWER: recovery and must include the steps necessary to fully restore the organization to its operational status. This includes personnel, equipment, applications, data, communications, and support services such as power and water. Only through close coordination with these services can the organization quickly reestablish operations back at its principal location, which is the primary objective of the DR plan. : Module 10 - Disaster Recovery 91. What are the three sets of activities that a DR team develops for each possible disaster scenario? How are these sets of activities ordered in a DR binder? The DR team develops three sets of activities for each disaster scenario. The ANSWER: activities are presented in sections in the sequence in which they are most frequently used. Because the activities used during a disaster are most urgently needed in the event of plan activation, they are placed in the binder first. The activities that are part of the follow-up plan, to be used once the disaster has been resolved, are placed second, and the planned activities that should be integrated into every daily procedure and activity, and which are only occasionally referenced for change management purposes, are placed third. 92. Summarize the general activities and timing associated with DR plan maintenance and discuss organizational factors that can affect the maintenance process. The DR plan should be a dynamic document that is updated regularly to remain ANSWER: current with system enhancements. The organization should revisit the DR plan at least annually in order to update its procedures, contracts, and agreements, and to make the necessary personnel and equipment modifications dictated by the business operations. If the organization changes its size, location, or business focus, the DR management team and the other management teams should begin anew with the CP plan, and it should also reexamine the BIA. : Module 10 - Disaster Recovery 93. Why are large-scale disasters of particular concern when choosing off-site storage locations for data backups and equipment? When selecting an off-site storage location for data backups or stored equipment, ANSWER: extra care should be taken to minimize the risk at that storage location. In many instances, a large-scale disaster may destroy or damage both the primary location and the off-site storage location, if the latter is not carefully selected. 94. Briefly discuss the five phases of disaster recovery plan implementation. ANSWER: 1) Preparation: The planning and rehearsal necessary to respond to a disaster 2) Response: The identification of a disaster, notification of appropriate individuals, and immediate reaction to the disaster 3) Recovery: The recovery of necessary business information and systems 4) Restoration: The restoration of critical business functions 5) Resumption: The reestablishment of operations at the primary site or new permanent site as they were before the disaster : Module 10 - Disaster Recovery 95. Discuss the three primary goals of the disaster recovery plan. ANSWER: 1. Eliminate or reduce the potential for injuries, loss of human life, damage to facilities, and loss of assets and records. 2. Immediately invoke the emergency provisions of the disaster recovery plan to stabilize the effects of the disaster, allowing for appropriate assessment and the beginning of recovery efforts. Staff and other resources then minimize the effects of the disaster and provide for the fastest possible recovery. 3. Implement the procedures contained in the disaster recovery plan according to the type and impact of the disaster. 96. What are some of the key points that the CP team must build into the DR plan? ANSWER: The key points that the CP team must build into the DR plan include the clear delegation of roles and responsibilities, the execution of the alert roster and notification of key personnel, the use of employee check-in systems, the clear : Module 10 - Disaster Recovery establishment and communication of business resumption priorities, the complete and timely documentation of the disaster, and preparations for alternative implementations. 97. Describe the structured walk-through and simulation strategies that can be used for plan testing and rehearsal by disaster recovery teams. Structured walk-through: All involved individuals walk through the steps they ANSWER: would take during an actual disaster, either on-site or as a conference room discussion. Simulation: Each involved individual or team works independently rather than in conference, simulating the performance of each task but stopping short of the actual physical tasks required, such as restoring the backup or rebuilding a particular server or communications device. : Module 10 - Disaster Recovery 98. What are the main purposes of the response phase? The response phase is designed to: ANSWER: Protect human life and physical safety Attempt to limit and contain damage to the organization’s facilities and equipment Manage communications with employees and other stakeholders 99. What are the primary goals associated with the recovery phase? ANSWER: The primary goals associated with the recovery phase include: Salvage any feasible equipment, technology, and data. Recover critical business functions. Coordinate recovery efforts. Acquire resources to replace damaged or destroyed materials and equipment. Evaluate the need to implement the business continuity plan. 100. What are the primary goals associated with the restoration phase of a disaster recovery plan? ANSWER: The primary goals for the restoration phase are to: Repair all damage to the primary site or select or build a replacement : Module 10 - Disaster Recovery facility. Replace the damaged or destroyed contents of the primary site, including supplies, equipment, and material. Restore all technology with appropriate operating systems, applications, and data 101. An organization’s primary site may become uninhabitable after a disaster. What choices are available to the organization if this occurs and what are some considerations that might affect the decision? ANSWER: The organization is faced with two choices: Rebuild or select a new location. If the organization owns the land, then the first option may be better one. The downside is that it may be months before the organization can relocate. The business continuity solution may not be feasible for such a long-term stay, and intermediate locations may be required. In this case, the organization may have to lease temporary facilities until the new building is constructed. Alternatively, the organization may choose to select a new location. This may be necessary when the organization cannot relocate for an extended stay at temporary locations while the primary site is reconstructed, or when the organization does not own the primary structure. The facility owner may not choose to rebuild in a timely manner, leaving the organization stuck in temporary facilities. It may be easier to find a new suitable location. The downside is that if the organization has customers that visit the primary site, they will require redirection, either by mail or other means of communication. The selection of a new permanent site is a complex decision and requires a management team to identify candidate sites, coordinate on-site visits, and review the facilities before selecting a suitable replacement. Because of the scope of a disaster, permanent and temporary staff may not be available because they have had to relocate their families. : Module 10 - Disaster Recovery 102. What should be the focus of system contingency strategies? Give five examples of procedures that must be included in this type of strategy. The focus of system contingency strategies must be on the availability, ANSWER: confidentiality, and integrity of the data being processed. This strategy must include: Backup data stored in the cloud, off-site or at an alternate site Use of standardized hardware, software, and peripherals to enable backup and recovery to and from replacement systems Documentation of all supported system configurations, with local copies of key vendor information Coordination with security policies and system security controls used in the organization Reliance on the systems' priority and key data needs as documented in the BIA Processes that aggressively limit the placement of data on client systems, with any local data kept for the minimum possible time When local storage of data cannot be eliminated, sound procedures established to back up and periodically test restoration of local data To the greatest degree possible, automation of backup processes and proactive validation of the automated backup by repeatable processes Coordination of all contingency solutions with the cyber IR plans and team operations : Module 10 - Disaster Recovery Modified True / False 103. A disaster caused by people, including acts of terrorism, acts of war, and acts that begin as incidents and escalate into disasters, is called a slow-onset disaster. ANSWER: False - man made 104. A description of a catastrophic event that may befall an organization, along with information on its probability of occurrence, a brief description of the organization’s actions to prepare for that disaster, and the best case, worst case, and most likely case outcomes of the disaster is known as a(n) incident scenario False - disaster ANSWER: : Module 10 - Disaster Recovery 105. Disaster response, like incident response, usually begins with a trigger. ANSWER: True 106. The DR plan should be a dynamic document that is updated occasionally to remain current with system enhancements. ANSWER: False - regularly 107. A seemingly routine event can quickly spin out of control, creating a worst-case scenario. ANSWER: True : Module 10 - Disaster Recovery 108. How the plan is distributed is not as important as making sure that all personnel have access to the plan, have fully read it, and understood it. True ANSWER: 109. A process known as adversity management is an organization’s set of planning and preparation efforts for dealing wit h potential human injury, emotional trauma, loss of life, or damage to an organization’s reputation or image as a result of a disaster. ANSWER: False - crisis 110. Most organizations don't tend to train employees to operate under adverse conditions, also known as disaffected mode. ANSWER: False - degraded : Module 10 - Disaster Recovery 111. External testing can come from standardization boards or consultants (for example, ISO 9000), certification or accreditation groups, or a group selected by the organization’s management from a sister company. ANSWER: True 112. A scripted description of the disaster that avoids impeding the notification process by consisting of just enough information so that each responder knows what portion of the DR plan to implement is known as the trigger message. False - alert ANSWER: 113. The disaster resumption phase of the disaster response plan is associated with the return to normal business operation s, beginning with those most critical to the organization. : Module 10 - Disaster Recovery ANSWER: True 114. Perhaps the last formal activity the organization performs before declaring the disaster officially over is the deskcheck review. ANSWER: False - after-action 115. Many organizations combine the disaster recovery and business continuity plans into a single comprehensive document called the service resumption plan. ANSWER: False - business : Module 10 - Disaster Recovery 116. The primary recovery control for information systems is regular and frequent backup of the data using a validated process. ANSWER: True