IT Business & Disaster Recovery Planning (CY-604 (A)) - Important Questions

Define Business Continuity Planning (BCP). Explain the primary objectives of a BCP and list the key stakeholders involved in developing and maintaining it.

Describe the phases of the Business Continuity Planning lifecycle. For each phase, explain the main activities, expected deliverables, and who is typically responsible for them.

What is Business Impact Analysis (BIA)? Explain the BIA process step-by-step, identify its typical outputs, and show how $RTO$ (Recovery Time Objective) and $RPO$ (Recovery Point Objective) are derived from BIA results.

Explain the Risk Analysis / Risk Assessment process as applied to IT Business and Disaster Recovery Planning. Compare qualitative and quantitative risk assessment methods and show with a simple formula how risk is commonly expressed.

Compare and contrast cold site, warm site, and hot site recovery options. For each type, discuss typical setup time, cost implications, and suitable use-cases.

Describe full, incremental, and differential backup strategies. Explain advantages and disadvantages of each, and outline factors to consider when selecting a backup strategy for critical databases.

List and explain the essential components of a Disaster Recovery Plan (DRP). Describe the roles and responsibilities of a typical Disaster Recovery Team, including escalation and decision-making authorities.

Describe the common types of Disaster Recovery tests (e.g., tabletop, walkthrough, simulation, full interruption). Explain how a DR test should be planned, executed, and how findings should be incorporated into plan maintenance.

Discuss legal, regulatory, and compliance considerations that must be addressed in Business Continuity and Disaster Recovery Planning. Include data protection, notification requirements, and audit documentation.

Define and differentiate the following Disaster Recovery metrics: $RTO$, $RPO$, $MTTR$, and $MTBF$. Explain how each metric influences recovery strategy selection and service-level agreements.

Explain the purpose and key elements of a Disaster Communication Plan. Describe how to create an escalation matrix and what message templates should be prepared in advance.

Using results from a Business Impact Analysis, explain how critical business functions are identified and prioritized for continuity. Describe methods to develop continuity strategies for the top three critical functions.