CAS-005 practice question 29 of 30

[Governance, Risk, and Compliance (GRC)] A company recentlyexperienced aransomware attack. Although the company performssystems and data backupon a…

[Governance, Risk, and Compliance (GRC)] A company recentlyexperienced aransomware attack. Although the company performssystems and data backupon a schedule that aligns with itsRPO (Recovery Point Objective) requirements, thebackup administratorcould not recovercritical systems and datafrom its offline backups to meet the RPO. Eventually, the systems and data were restored with information that wassix months outside of RPO requirements. Which of the following actions should the company take to reduce the risk of a similar attack?

Answer options

A: Encrypt and label the backup tapes with the appropriate retention schedule before they are sent to the off-site location.

B: Implement a business continuity process that includes reverting manual business processes.

C: Perform regular disaster recovery testing of IT and non-IT systems and processes. Correct answer

D: Carry out a tabletop exercise to update and verify the RACI matrix with IT and critical business functions.

Correct Answer:

C. Perform regular disaster recovery testing of IT and non-IT systems and processes.

Explanation

The core failure was the inability to restore data within the Recovery Point Objective (RPO), indicating that the disaster recovery (DR) plan was ineffective despite the existence of backups. The only way to verify that a recovery plan, including its technical components and processes, can meet its objectives (like RPO and RTO) is through regular testing. Performing regular DR tests would have exposed the flaws in the backup restoration process—whether due to data corruption, media failure, or procedural errors—allowing the company to correct them before a genuine incident occurred. This directly addresses the root cause of the recovery failure.

Why Incorrect

A. Encrypting and labeling tapes is a data security and media management control; it does not ensure the data on the tapes is valid or can be restored successfully.
B. Reverting to manual processes is a business continuity strategy to maintain operations when IT fails, not a corrective action to fix the failed IT recovery process.
D. A tabletop exercise is a discussion-based test that validates plans and roles (like a RACI matrix) but does not technically test the viability of backups or the restoration process.

References

1. NIST Special Publication 800-34 Rev. 1

Contingency Planning Guide for Federal Information Systems. Section 5

"Contingency Plan Testing

Training

and Exercises

" states

"Testing enables plan deficiencies to be identified and addressed... Testing should be conducted to determine the plan’s effectiveness and the organization’s readiness to execute the plan." This highlights that testing is the mechanism to find the exact type of failure described in the scenario.

2. Carnegie Mellon University

Software Engineering Institute

CERT® Resilience Management Model (CERT-RMM) v1.2. In the Service Continuity (SCON) process area

Specific Goal 4 (SG 4) is "Validate Service Continuity Plans." The associated Specific Practice (SP 4.1)

"Perform tests of the service continuity plans

" explicitly states that the purpose of testing is to "ensure that the organization can continue essential business operations and services in the event of a disruption" by validating the plan's effectiveness.

3. Wold

G. H. (1997). Effective Disaster Recovery Testing. Disaster Recovery Journal

10(2). This foundational article on the topic emphasizes that "The only way to be sure that the plan works is to test it." It details how testing uncovers unforeseen problems in recovery procedures

technology

and personnel readiness

which is precisely what the company in the scenario failed to do.

Keep practicing

Take the free CAS-005 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test