Cyber Resilience MCQs (Multiple-Choice Questions)

1. What is the primary objective of cyber resilience?

1. To prevent every possible cyberattack permanently
2. To ensure an organization can withstand, respond to, and recover from cyber incidents
3. To eliminate the need for security monitoring
4. To replace all IT systems with manual processes

Answer: B) To ensure an organization can withstand, respond to, and recover from cyber incidents

Explanation:

Cyber resilience focuses on maintaining essential functions despite cyber incidents and restoring normal operations afterward. It includes preventive security measures but also emphasizes detection, response, recovery, adaptation, and preparation for future disruptions.

2. How does cyber resilience differ from traditional cybersecurity?

1. Cyber resilience focuses only on installing antivirus software
2. Cybersecurity is unrelated to protecting digital information
3. Cyber resilience combines security with the ability to continue operating and recover from disruptions
4. Cyber resilience eliminates the need for incident response

Answer: C) Cyber resilience combines security with the ability to continue operating and recover from disruptions

Explanation:

Traditional cybersecurity activities often emphasize protecting systems and reducing the likelihood of compromise. Cyber resilience extends this approach by planning for the possibility that an incident will occur and ensuring that critical services can continue or be restored within acceptable limits.

3. Which activity is an essential component of cyber resilience?

1. Ignoring security alerts during business hours
2. Developing and testing incident response and recovery plans
3. Disabling all system logs
4. Using the same password for every account

Answer: B) Developing and testing incident response and recovery plans

Explanation:

Incident response and recovery plans define responsibilities, communication procedures, containment actions, and restoration steps. Regular testing helps organizations identify gaps before an actual incident disrupts operations.

4. What is the purpose of a cyber risk assessment?

1. To identify threats, vulnerabilities, potential impacts, and risk levels
2. To guarantee that no vulnerabilities exist
3. To remove the need for security policies
4. To increase the number of unnecessary user accounts

Answer: A) To identify threats, vulnerabilities, potential impacts, and risk levels

Explanation:

A cyber risk assessment evaluates what could go wrong, which assets may be affected, how likely an incident is, and what consequences it could have. The results help organizations prioritize security controls, recovery capabilities, and investments according to risk.

5. What does the principle of defense in depth mean?

1. Using only one security control for the entire organization
2. Relying exclusively on perimeter firewalls
3. Applying multiple complementary security controls across different layers
4. Removing access controls to simplify system administration

Answer: C) Applying multiple complementary security controls across different layers

Explanation:

Defense in depth uses multiple protective measures, such as access controls, endpoint protection, network segmentation, monitoring, and backups. If one control fails, other layers may limit the attacker's access or reduce the resulting damage.

6. Which of the following best describes an incident response plan?

1. A document containing only employee attendance records
2. A documented procedure for detecting, managing, containing, and recovering from security incidents
3. A plan for replacing every computer annually
4. A list of public websites unrelated to organizational security

Answer: B) A documented procedure for detecting, managing, containing, and recovering from security incidents

Explanation:

An incident response plan establishes how an organization handles suspected or confirmed security incidents. It typically defines roles, escalation paths, evidence preservation, containment strategies, communication requirements, and recovery procedures.

7. What is the main purpose of a business continuity plan (BCP)?

1. To maintain essential business functions during and after a disruption
2. To ensure that every computer uses the same operating system
3. To prevent employees from reporting security problems
4. To eliminate the need for backup facilities

Answer: A) To maintain essential business functions during and after a disruption

Explanation:

A business continuity plan identifies critical activities and describes how they can continue during disruptions. It may include alternate work arrangements, backup processes, communication procedures, and temporary operating arrangements while affected systems are restored.

8. What is the primary purpose of a disaster recovery plan (DRP)?

1. To improve employee recruitment procedures
2. To eliminate all operational costs
3. To restore affected IT systems, applications, and data after a major disruption
4. To replace the organization's risk assessment process

Answer: C) To restore affected IT systems, applications, and data after a major disruption

Explanation:

A disaster recovery plan describes how technology services and data will be restored after a disruptive event. It can specify recovery environments, restoration order, responsible personnel, technical procedures, and recovery targets for critical systems.

9. What does Recovery Time Objective (RTO) represent?

1. The maximum acceptable time to restore a service after a disruption
2. The total number of backup files stored each year
3. The minimum password length for administrators
4. The number of security incidents detected per month

Answer: A) The maximum acceptable time to restore a service after a disruption

Explanation:

RTO specifies the targeted time within which a system or business function should be restored following a disruption. A shorter RTO generally requires more carefully planned recovery capabilities and may increase the cost of maintaining them.

10. What does Recovery Point Objective (RPO) define?

1. The time required to install a new firewall
2. The maximum acceptable amount of data loss measured in time
3. The number of employees assigned to incident response
4. The time required to detect a phishing email

Answer: B) The maximum acceptable amount of data loss measured in time

Explanation:

RPO defines how far back in time data recovery may need to reach after a disruption. For example, an RPO of 15 minutes means the recovery strategy should aim to limit data loss to approximately the most recent 15 minutes of changes.

11. Which backup approach provides a useful defense against ransomware?

1. Keeping every backup permanently connected with unrestricted write access
2. Storing all backups on the same compromised workstation
3. Maintaining isolated or immutable backups and regularly testing restoration
4. Deleting backups after every successful system update

Answer: C) Maintaining isolated or immutable backups and regularly testing restoration

Explanation:

Ransomware may encrypt production data and attempt to destroy accessible backups. Isolated or immutable backup copies can reduce this risk. Regular restoration tests help confirm that backup data is usable and that recovery procedures meet business requirements.

12. What does the 3-2-1 backup strategy recommend?

1. Three passwords, two administrators, and one firewall
2. Three copies of data, on two types of storage media, with one copy off-site
3. Three servers, two routers, and one database
4. Three antivirus programs, two VPNs, and one proxy

Answer: B) Three copies of data, on two types of storage media, with one copy off-site

Explanation:

The traditional 3-2-1 backup rule recommends retaining three copies of data, including the primary copy, using two types of storage media, with at least one copy stored off-site. Organizations may extend this strategy with offline or immutable copies to strengthen protection against ransomware and other destructive incidents.

13. What is a cyber resilience tabletop exercise?

1. A physical inspection of every office desk
2. A routine software installation performed without discussion
3. A simulated incident discussion used to evaluate roles, decisions, and response procedures
4. A process for deleting outdated security policies

Answer: C) A simulated incident discussion used to evaluate roles, decisions, and response procedures

Explanation:

A tabletop exercise presents a hypothetical incident, such as a ransomware attack or cloud outage, and asks participants to discuss how they would respond. It can reveal unclear responsibilities, communication gaps, and missing recovery steps without disrupting production systems.

14. What is the role of Security Information and Event Management (SIEM) in cyber resilience?

1. To collect and analyze security events from multiple sources to help detect suspicious activity
2. To replace all employee training
3. To guarantee that every attack is prevented
4. To serve exclusively as a data backup device

Answer: A) To collect and analyze security events from multiple sources to help detect suspicious activity

Explanation:

SIEM platforms aggregate logs and security events from systems, applications, and network devices. They can correlate events, generate alerts, and support investigations. Effective use depends on appropriate data sources, detection rules, tuning, and analyst response.

15. What is the purpose of network segmentation?

1. To make every device accessible from every other device
2. To divide a network into controlled sections and limit unauthorized movement between them
3. To remove authentication from internal systems
4. To prevent administrators from monitoring network activity

Answer: B) To divide a network into controlled sections and limit unauthorized movement between them

Explanation:

Network segmentation separates systems into different zones and applies access restrictions between them. If an attacker compromises one device, segmentation can make it harder to move to critical servers, sensitive databases, or backup infrastructure.

16. How does multi-factor authentication (MFA) improve cyber resilience?

1. By eliminating the need to manage user accounts
2. By allowing all users to share a single password
3. By requiring two or more different types of evidence to verify identity
4. By automatically restoring deleted files

Answer: C) By requiring two or more different types of evidence to verify identity

Explanation:

MFA combines authentication factors such as something a user knows, possesses, or is. It reduces reliance on passwords alone and can make stolen credentials harder to exploit. Strong phishing-resistant methods are particularly valuable for privileged accounts and remote access.

17. What is the core idea behind a zero-trust security model?

1. Trust every device connected to the internal network
2. Grant permanent unrestricted access to employees
3. Disable identity verification for internal applications
4. Continuously evaluate access based on identity, context, and policy rather than assuming trust from network location

Answer: D) Continuously evaluate access based on identity, context, and policy rather than assuming trust from network location

Explanation:

Zero trust rejects the assumption that users or devices are trustworthy simply because they are inside a network perimeter. It emphasizes explicit verification, least-privilege access, and ongoing evaluation of access decisions to reduce the impact of compromised accounts and devices.

18. What does the principle of least privilege require?

1. Giving users only the permissions necessary for their assigned responsibilities
2. Granting every employee administrator access
3. Sharing privileged credentials across departments
4. Removing access reviews from security procedures

Answer: A) Giving users only the permissions necessary for their assigned responsibilities

Explanation:

Least privilege limits the permissions assigned to each account, service, or application. If an account is compromised, restricted permissions can reduce the actions an attacker can perform and limit the potential damage to other systems.

19. Why is vulnerability management important for cyber resilience?

1. It guarantees that software will never contain defects
2. It helps identify, prioritize, and remediate weaknesses that attackers may exploit
3. It eliminates the need to update software
4. It prevents employees from reporting security issues

Answer: B) It helps identify, prioritize, and remediate weaknesses that attackers may exploit

Explanation:

Vulnerability management includes identifying assets and weaknesses, assessing their severity and exposure, prioritizing remediation, and verifying fixes. Addressing important vulnerabilities can reduce the likelihood that an attacker will compromise systems or disrupt critical operations.

20. What is the purpose of a business impact analysis (BIA)?

1. To measure the color quality of business applications
2. To replace every risk assessment with a financial audit
3. To identify critical activities and assess the consequences of their disruption
4. To determine which employees should use personal devices

Answer: C) To identify critical activities and assess the consequences of their disruption

Explanation:

A BIA identifies important business processes, their dependencies, and the effects of interruptions over time. It supports recovery prioritization and helps determine appropriate RTOs, RPOs, resource requirements, and continuity strategies.

21. Which action should generally be prioritized when an active cyberattack is confirmed?

1. Ignore the incident until the next scheduled audit
2. Immediately delete all logs without investigation
3. Restore affected systems before assessing whether the attacker remains present
4. Follow the incident response process to contain the threat while preserving relevant evidence

Answer: D) Follow the incident response process to contain the threat while preserving relevant evidence

Explanation:

Incident responders should assess the situation, coordinate appropriate containment, and preserve evidence needed for investigation. Actions must be proportionate to the threat and business impact. Restoring systems before removing an attacker's access can allow the incident to recur.

22. What is the purpose of a cyber incident post-mortem or lessons-learned review?

1. To identify root causes, evaluate the response, and improve future resilience
2. To assign blame without examining technical evidence
3. To delete all incident documentation
4. To prevent any changes to security procedures

Answer: A) To identify root causes, evaluate the response, and improve future resilience

Explanation:

A lessons-learned review examines what happened, how the incident was detected, which controls failed, and how the response performed. Findings can lead to improvements in security controls, training, monitoring, incident procedures, and recovery planning.

23. What is a key advantage of immutable backups?

1. They can always be changed by any compromised administrator account
2. They are designed to prevent modification or deletion during a defined retention period
3. They automatically remove malware from every production server
4. They eliminate the need for access controls

Answer: B) They are designed to prevent modification or deletion during a defined retention period

Explanation:

Immutable backups use controls that prevent changes or deletion for a specified period. This can protect recovery copies from ransomware and malicious or accidental deletion. Organizations must still protect backup credentials, verify retention settings, and test restoration procedures.

24. Why should an organization test backup restoration rather than only checking that backups completed?

1. Successful backup logs guarantee that every file is recoverable
2. Restoration tests are useful only for reducing storage capacity
3. A backup may be incomplete, corrupted, inaccessible, or unsuitable for the required recovery process
4. Backup verification is unrelated to disaster recovery

Answer: C) A backup may be incomplete, corrupted, inaccessible, or unsuitable for the required recovery process

Explanation:

A successful backup job does not necessarily prove that data can be restored correctly or within the required timeframe. Restoration tests verify data integrity, access permissions, application dependencies, and the effectiveness of recovery procedures.

25. What is the purpose of a hot disaster recovery site?

1. To provide a fully equipped recovery environment that can resume operations relatively quickly
2. To store paper documents without IT equipment
3. To serve only as a permanent archive for obsolete hardware
4. To prevent all data replication between locations

Answer: A) To provide a fully equipped recovery environment that can resume operations relatively quickly

Explanation:

A hot site maintains systems and infrastructure that are ready for rapid activation, often with current data replication or synchronization. It can support shorter recovery times but usually costs more to maintain than a cold site or less-prepared alternative.

26. What is the main characteristic of a cold disaster recovery site?

1. It always contains fully synchronized production servers
2. It restores all systems without any setup work
3. It is designed to operate as the primary production environment at all times
4. It provides a basic recovery location that requires additional setup before operations can resume

Answer: D) It provides a basic recovery location that requires additional setup before operations can resume

Explanation:

A cold site typically provides space and basic facilities but has less ready-to-run IT infrastructure than a hot site. Equipment, systems, and data may need to be installed or restored before services resume, so recovery often takes longer.

27. How does redundancy contribute to cyber resilience?

1. By creating multiple passwords for one user without other safeguards
2. By providing alternate components or systems that can maintain service if a primary component fails
3. By eliminating the need for monitoring
4. By ensuring that every system shares the same failure point

Answer: B) By providing alternate components or systems that can maintain service if a primary component fails

Explanation:

Redundancy uses additional components, systems, or service instances to reduce dependence on a single point of failure. Effective resilience requires considering shared dependencies and cyber threats as well as hardware failures, because redundant systems can be compromised together if they are not adequately separated.

28. What is the main benefit of a failover mechanism?

1. It automatically prevents every type of cyberattack
2. It permanently disables the primary service
3. It switches operations to an alternate component or system when the primary one becomes unavailable
4. It removes the need for recovery planning

Answer: C) It switches operations to an alternate component or system when the primary one becomes unavailable

Explanation:

Failover transfers a service or workload to an alternate system when the primary component fails or becomes unavailable. Failover can reduce downtime, but it needs testing and must account for data consistency, configuration differences, and the possibility that both environments share the same security compromise.

29. Why is asset inventory important for cyber resilience?

1. It helps organizations identify systems, applications, data, owners, and dependencies that require protection
2. It makes security monitoring unnecessary
3. It ensures that unknown devices cannot connect to the network
4. It replaces the need for patch management

Answer: A) It helps organizations identify systems, applications, data, owners, and dependencies that require protection

Explanation:

An accurate asset inventory helps security teams understand what must be protected and recovered. Without visibility into devices, software, cloud resources, and dependencies, organizations may overlook vulnerable systems or fail to restore services in the correct order.

30. What is the purpose of threat intelligence in cyber resilience?

1. To guarantee advance knowledge of every attack
2. To eliminate all security incidents without technical controls
3. To replace incident responders with automated reports
4. To provide information about threats, attacker behavior, and indicators that can guide defensive decisions

Answer: D) To provide information about threats, attacker behavior, and indicators that can guide defensive decisions

Explanation:

Threat intelligence helps organizations understand relevant adversaries, attack techniques, vulnerabilities, and indicators of compromise. It can inform detection rules, risk assessments, incident preparation, and defensive priorities, but it cannot guarantee that all attacks will be predicted or prevented.

31. What does Mean Time to Detect (MTTD) measure?

1. The time required to replace all servers in an organization
2. The average time taken to detect an incident or failure after it begins, according to the defined measurement method
3. The number of vulnerabilities in a software application
4. The amount of data stored in an offline backup

Answer: B) The average time taken to detect an incident or failure after it begins, according to the defined measurement method

Explanation:

MTTD is a performance metric for how quickly an organization identifies incidents or failures. Shorter detection times can reduce the opportunity for attackers to remain undetected, although the exact calculation depends on how an organization defines the incident start and detection timestamps.

32. What does Mean Time to Recover (MTTR) generally measure in a resilience context?

1. The total number of security policies written each year
2. The maximum number of users allowed on a network
3. The average time required to restore a service or system to an acceptable operational state
4. The number of backup devices purchased

Answer: C) The average time required to restore a service or system to an acceptable operational state

Explanation:

MTTR is commonly used to track how long recovery or repair takes. Organizations should define the metric precisely because some use the abbreviation to mean mean time to repair, respond, or recover. Clear definitions help teams compare results and evaluate recovery improvements.

33. Why is supply chain security important for cyber resilience?

1. Third-party providers, software components, and service dependencies can introduce security risks or disruptions
2. Suppliers never have access to organizational systems
3. External services cannot affect internal business operations
4. Vendor contracts automatically eliminate technical vulnerabilities

Answer: A) Third-party providers, software components, and service dependencies can introduce security risks or disruptions

Explanation:

Organizations depend on vendors, cloud providers, software libraries, managed services, and other external partners. A compromise or outage affecting one of these dependencies can disrupt business operations. Supplier assessment, access restrictions, contingency plans, and monitoring help manage this exposure.

34. What is the purpose of a security awareness training program?

1. To teach employees how to bypass security controls
2. To make every employee a full-time security engineer
3. To remove the need for technical defenses
4. To help employees recognize threats and follow safe security practices

Answer: D) To help employees recognize threats and follow safe security practices

Explanation:

Security awareness training helps employees recognize phishing, handle sensitive data appropriately, report suspicious activity, and follow organizational policies. Training is most useful when reinforced with practical exercises, clear reporting channels, and technical controls that reduce the consequences of human error.

35. How can endpoint detection and response (EDR) tools improve cyber resilience?

1. By eliminating the need for operating system updates
2. By monitoring endpoint activity and supporting investigation, containment, and response
3. By guaranteeing that all malicious code is blocked before execution
4. By replacing all network infrastructure

Answer: B) By monitoring endpoint activity and supporting investigation, containment, and response

Explanation:

EDR tools collect and analyze activity from endpoints such as workstations and servers. They can identify suspicious behavior, provide investigative context, and support response actions such as isolating a compromised device. Their effectiveness depends on configuration, coverage, and operational response.

36. What is the purpose of a honeypot in cybersecurity?

1. To create a decoy system or resource that can help detect and study suspicious activity
2. To store the only copy of an organization's critical data
3. To provide unrestricted access to production databases
4. To guarantee that attackers cannot enter a network

Answer: A) To create a decoy system or resource that can help detect and study suspicious activity

Explanation:

A honeypot is a deliberately configured decoy intended to attract or reveal unauthorized activity. It can provide information about attack techniques and support detection, but it must be isolated and monitored carefully so that it does not become a route into production systems.

37. Why is cloud resilience important for organizations using cloud services?

1. Cloud providers guarantee that every application will always remain available
2. Cloud systems are not exposed to identity or configuration risks
3. Cloud workloads can still experience outages, misconfigurations, data loss, and cyberattacks
4. Cloud services remove the need for data backups

Answer: C) Cloud workloads can still experience outages, misconfigurations, data loss, and cyberattacks

Explanation:

Cloud environments provide useful resilience features, but availability and security depend on architecture, configuration, identity controls, provider capabilities, and the shared responsibility model. Organizations should plan backups, recovery procedures, monitoring, and contingencies for critical cloud services.

38. What is the purpose of infrastructure as code (IaC) in recovery planning?

1. To prevent infrastructure configurations from being documented
2. To require every server to be configured manually
3. To remove the need for change control
4. To define and reproduce infrastructure configurations through version-controlled code

Answer: D) To define and reproduce infrastructure configurations through version-controlled code

Explanation:

Infrastructure as code describes infrastructure resources and configurations in machine-readable definitions. Version-controlled templates can make it easier to rebuild environments consistently after a disruption. IaC itself must be secured because compromised templates or deployment credentials can spread malicious changes.

39. What is the main purpose of a cyber resilience maturity assessment?

1. To determine how well an organization can prevent, withstand, respond to, and recover from cyber incidents
2. To calculate the age of every computer monitor
3. To prove that security incidents are impossible
4. To eliminate the need for business continuity planning

Answer: A) To determine how well an organization can prevent, withstand, respond to, and recover from cyber incidents

Explanation:

A maturity assessment evaluates the current state of policies, technical controls, response capabilities, recovery plans, and governance. It helps identify gaps and prioritize improvements. The assessment should be based on evidence rather than simply the existence of written policies.

40. Why should privileged accounts receive special protection?

1. They are never targeted by attackers
2. They often have extensive permissions that can enable serious damage if compromised
3. They do not require authentication
4. They are unrelated to system recovery

Answer: B) They often have extensive permissions that can enable serious damage if compromised

Explanation:

Privileged accounts may be able to change configurations, access sensitive data, create accounts, or disable security controls. Strong authentication, separate administrative accounts, limited privileges, activity logging, and protected emergency-access procedures help reduce the risk.

41. What is the purpose of a cyber crisis communication plan?

1. To prevent employees from receiving incident updates
2. To publish all sensitive forensic evidence immediately
3. To define how accurate and timely information is communicated to relevant stakeholders during an incident
4. To replace the technical incident response process

Answer: C) To define how accurate and timely information is communicated to relevant stakeholders during an incident

Explanation:

A crisis communication plan identifies communication responsibilities, approved channels, escalation procedures, and stakeholder groups. It helps coordinate messages to employees, customers, suppliers, regulators, and other parties while protecting sensitive information and avoiding unsupported claims.

42. How can chaos engineering contribute to resilience testing?

1. By intentionally introducing controlled failures to evaluate system behavior and recovery
2. By disabling every security control permanently
3. By replacing all production monitoring with random data
4. By guaranteeing that no future outage can occur

Answer: A) By intentionally introducing controlled failures to evaluate system behavior and recovery

Explanation:

Chaos engineering tests assumptions about system resilience by introducing controlled disruptions, such as service failures or network delays. Experiments should have defined objectives, appropriate safeguards, monitoring, and rollback procedures. The goal is to discover weaknesses before uncontrolled failures occur.

43. What is the purpose of a red team exercise?

1. To verify employee attendance records
2. To simulate realistic adversary techniques and assess the effectiveness of defenses
3. To restore backups without testing security controls
4. To replace all vulnerability management activities

Answer: B) To simulate realistic adversary techniques and assess the effectiveness of defenses

Explanation:

A red team exercise uses authorized adversary-like activity to evaluate an organization's ability to prevent, detect, and respond to attacks. Carefully scoped exercises can reveal weaknesses across technology, people, and processes. Findings should be documented and used to improve defensive capabilities.

44. Which statement best describes the relationship between cyber resilience and compliance?

1. Meeting compliance requirements guarantees complete resilience
2. Compliance eliminates the need to test recovery plans
3. Cyber resilience has no relationship to risk management
4. Compliance can support resilience, but effective resilience also requires operational testing and adaptation

Answer: D) Compliance can support resilience, but effective resilience also requires operational testing and adaptation

Explanation:

Regulatory and industry requirements can establish useful baseline controls, documentation, and accountability. However, an organization may satisfy formal requirements while still having untested backups, ineffective response procedures, or fragile dependencies. Resilience requires evidence that capabilities work under realistic conditions.

45. What is a key benefit of maintaining an offline backup copy?

1. It reduces the ability of many network-based attacks to directly reach and alter that backup
2. It guarantees that every restored system will be free of malware
3. It removes the need to check backup integrity
4. It ensures that all production data is permanently synchronized

Answer: A) It reduces the ability of many network-based attacks to directly reach and alter that backup

Explanation:

An offline backup is disconnected from the systems it protects, making it harder for attackers operating through the network to modify or delete it. Organizations should protect physical access, retain multiple recovery copies where appropriate, and verify the integrity of restored data before returning systems to service.

46. Why is dependency mapping important during disaster recovery?

1. It allows recovery teams to restore applications in a random order
2. It eliminates the need to identify critical business services
3. It reveals relationships between applications, databases, identity services, networks, and other components needed for recovery
4. It guarantees that all systems can recover independently

Answer: C) It reveals relationships between applications, databases, identity services, networks, and other components needed for recovery

Explanation:

Applications often depend on databases, authentication services, network connectivity, DNS, storage, and external providers. Dependency mapping helps recovery teams restore prerequisites in the correct order and avoid declaring a service recovered when essential supporting components remain unavailable.

47. What is the main purpose of continuous security monitoring?

1. To perform a single security review and then stop collecting information
2. To identify suspicious activity, changes, and emerging risks over time
3. To prevent every employee from accessing business applications
4. To remove all historical security records

Answer: B) To identify suspicious activity, changes, and emerging risks over time

Explanation:

Continuous security monitoring collects and analyzes information about systems, accounts, networks, and applications. It helps teams detect unusual behavior, identify configuration changes, and investigate potential incidents. Its value depends on adequate coverage, meaningful alerts, and timely response.

48. Which approach best supports continuous improvement in cyber resilience?

1. Keeping incident response plans unchanged regardless of experience
2. Ignoring the findings of recovery exercises
3. Measuring performance only when a major incident occurs
4. Reviewing incidents and test results, correcting weaknesses, and validating improvements

Answer: D) Reviewing incidents and test results, correcting weaknesses, and validating improvements

Explanation:

Continuous improvement uses evidence from incidents, audits, exercises, and performance metrics to refine controls and procedures. Organizations should assign owners to corrective actions, establish deadlines, and test whether changes actually improve detection, containment, continuity, and recovery.

49. A company wants to improve cyber resilience for its most critical business application. Which action should it take first?

1. Assess business impact, dependencies, risks, and recovery requirements before selecting improvements
2. Purchase the most expensive security product without evaluating its purpose
3. Disable application logging to reduce storage costs
4. Move all backups into the same production environment

Answer: A) Assess business impact, dependencies, risks, and recovery requirements before selecting improvements

Explanation:

Effective resilience planning begins by understanding the application's importance, potential failure scenarios, technical dependencies, acceptable downtime, and data-loss tolerance. This information helps determine suitable security controls, backup arrangements, recovery targets, and investments based on the organization's actual needs.

50. A business application has an RTO of 4 hours and an RPO of 30 minutes. A cyber incident makes the application unavailable at 10:00 AM, and the latest recoverable backup contains data up to 9:40 AM. If the application is restored and operational at 1:30 PM, does the recovery meet both targets?

1. No, the RTO is met, but the RPO is exceeded
2. No, the RPO is met, but the RTO is exceeded
3. Yes, both the RTO and RPO are met
4. No, both the RTO and RPO are exceeded

Answer: C) Yes, both the RTO and RPO are met

Explanation:

Actual recovery time: 1:30 PM − 10:00 AM = 3 hours 30 minutes.

The recovery time of 3 hours 30 minutes is within the RTO of 4 hours.

Actual data loss: 10:00 AM − 9:40 AM = 20 minutes.

The data loss of 20 minutes is within the RPO of 30 minutes.

Therefore, both recovery targets are met.