312-76 Questions and Answers

Peer-to-Peer (P2P) architecture connects individual computers to share resources and workloads directly, eliminating reliance on a central server. Rick’s solution fits this model by distributing the load across team members’ computers.

Option A (Three Tier):Involves separate layers (e.g., presentation, application, data), not load distribution.

Option B (Client-Server):Relies on a central server, which Rick removed.

Option D (N-Tier):A multi-layered architecture, not applicable here.

“Peer-to-Peer architecture decentralizes processing, leveraging interconnected nodes to balance loads, useful in resource-constrained environments” (Module: Network Architectures, Section: Decentralized Systems).

The Planning Team is tasked with developing, implementing, and executing the disaster recovery plan, including testing, to ensure preparedness and effectiveness.

Option A (Operations Team):Focuses on daily operations, not DR planning.

Option B (Support Team):Provides technical assistance, not plan execution.

Option D (Technology Team):Manages IT systems, not the DR plan itself.

“The Planning Team oversees the creation, implementation, and testing of the DR plan, ensuring alignment with organizational goals” (Module: Disaster Recovery Teams, Section: Roles and Responsibilities).

ISO/IEC 27005 is an information security risk management standard that requires identifying, assessing, and prioritizing risks (like George’s exercise) to develop a mitigation plan. It fits his prioritization of electrical surges.

Option A (ISO 27001):Broad security management, not risk-specific.

Option B (INCITS 483-2012):Virtualization security, not risk management.

Option C (ISO 27031):ICT continuity, narrower than 27005.

“ISO/IEC 27005 guides organizations in risk identification, assessment, and prioritization, forming the basis for security and DR planning” (Module: Risk Management, Section: Standards).

In virtualization (e.g., VMware, Hyper-V), deleting snapshots may not free space if dependent child disks (differencing disks) remain. Deleting these child disks consolidates space, resolving Remus’s issue.

Option B:Deleting the VM database risks data loss, not space recovery.

Option C (Uninstall Hypervisor):Drastic, loses all VMs.

Option D (Shutdown/Restart):Temporary, doesn’t free space.

“Deleting child disks of snapshots in VMs consolidates storage, freeing space when snapshot deletion alone is insufficient” (Module: Virtualization and Recovery, Section: Storage Management).

RMAN (Recovery Manager) is Oracle’s tool for backing up, restoring, and recovering database files using server sessions, matching Joanna’s description.

Option A (Virtuozzo):Virtualization platform, not database-specific.

Option B (Disk Drill):General data recovery, not database-focused.

Option C (Recuva):File recovery, not server-session-based.

“RMAN leverages database server sessions to manage backup, restoration, and recovery of Oracle databases efficiently” (Module: Database Recovery, Section: Recovery Tools).

Replication copies data from one server to another, ensuring consistency and availability, as described.

Option A (Failover Cluster):Switches to backups, not data copying.

Option B (Snapshots):Point-in-time copies, not server-to-server.

Option D (Cloud Storage):Storage method, not replication tech.

“Replication duplicates data across servers, supporting redundancy and recovery in distributed environments” (Module: Data Replication, Section: Replication Overview).

A centralized governance structure for Business Continuity and Risk Management typically includes Programs and Practices (strategies and processes), Enablement (resources and support), and Effectiveness (measuring outcomes). Authenticity, while important in security, is not a standard governance component.

Option A:Core to defining continuity practices.

Option B:Ensures implementation support.

Option C:Evaluates governance success.

“Centralized governance includes Programs and Practices, Enablement, and Effectiveness to ensure robust continuity; Authenticity is not a structural component” (Module: Governance Structures, Section: BC Governance).

RAID 1 (mirroring) duplicates data across two disks, ensuring an identical copy is maintained, as Will implemented.

Option A (RAID 0):Striping, no redundancy.

Option C (RAID 3):Parity with striping, not full duplication.

Option D (RAID 5):Parity across multiple disks, not mirroring.

“RAID 1 mirrors data across two disks, providing an exact copy for redundancy and immediate backup availability” (Module: Storage Technologies, Section: RAID Levels).

Mission Essential Functions (MEF) are critical tasks an organization must maintain or quickly resume post-disruption to ensure continuity.

Option A (BIA):Identifies impacts, not tasks.

Option B (Mitigation):Reduces risks, not task-focused.

Option D (MAD):Downtime limit, not tasks.

“Mission Essential Functions (MEF) are vital tasks requiring continuous or rapid resumption to sustain operations post-incident” (Module: Business Continuity Planning, Section: MEF Definition).

Continuous Data Protection (CDP) is a technology that continuously captures and saves data changes in real time or near real time, allowing for granular restore points. Unlike traditional backups that occur at scheduled intervals, CDP tracks every change to data, enabling recovery to any point in time before a failure. In this context, CDP is the best fit as it facilitates real-time data capture and recovery.

Option B (Mirroring):Mirroring duplicates data across two or more storage devices for redundancy but doesn’t inherently capture real-time changes for multiple restore points.

Option C (Virtual Tape Library):A VTL emulates tape storage using disk-based systems, primarily for backup, not real-time change capture.

Option D (Disk-to-Disk):D2D refers to backing up data from one disk to another, typically at scheduled intervals, not in real time.

EDRP v3 discusses CDP as an advanced backup technology under data protection strategies, highlighting its role in minimizing data loss by providing continuous recovery points (Module: Data Backup and Recovery).

Availability ensures a system is operational and can serve requests correctly and timely, directly matching the question’s focus.

Option B (Integrity):Ensures data accuracy, not service delivery.

Option C (Nonrepudiation):Prevents denial of actions, not request handling.

Option D (Precaution):A preventive measure, not a system property.

“Availability is the system’s capacity to respond to requests effectively, a cornerstone of disaster recovery and continuity” (Module: System Resilience, Section: Core Properties).

PASIS (Pittsburgh Advanced Survivable Information Storage) integrates Decentralized Storage Systems, Data Redundancy and Encoding, and Dynamic Self-Maintenance for survivable storage, as Matt researched.

Option A:Centralized, not PASIS’s decentralized focus.

Option B:Distributed computing is broader than storage-specific.

Option D:Centralized, contradicts PASIS principles.

“PASIS architecture combines decentralized storage, redundancy with encoding, and self-maintenance for robust, survivable data systems” (Module: Survivable Storage Systems, Section: PASIS Components).

System Recovery is the process of restoring a system’s applications and data to a previous state within an acceptable timeframe, as described.

Option A (System Migration):Moving systems, not restoring.

Option B (System Backup):Creating copies, not restoration.

Option C (System Replication):Duplicating data, not recovery.

“System Recovery restores applications and data to a prior state within defined timeframes, ensuring operational continuity post-disaster” (Module: System Recovery, Section: Recovery Processes).

PASIS (Pittsburgh Advanced Survivable Information Storage) architecture balances availability, durability, and confidentiality. Increasing availability (easier data access) often reduces confidentiality (data protection) due to trade-offs in access control and encryption strength.

Option A (Nonrepudiation):Unrelated to availability trade-offs.

Option B (Durability):Remains high in PASIS, not decreased.

Option D (Latency):May decrease with higher availability, not increase.

EDRP v3 discusses PASIS trade-offs, noting confidentiality decreases as availability rises to ensure survivability (Module: Survivable Storage Systems).

Time scales for assessment are a critical BIA consideration, defining the period over which impacts are evaluated (e.g., hours, days).

Option A/B/D:Mitigation strategies, not BIA components.

“BIA requires defining time scales for assessing disruption impacts, ensuring accurate prioritization of processes” (Module: Business Impact Analysis, Section: BIA Methodology).

A Storage Cluster ensures a consistent file system image across servers, enabling simultaneous read/write access to shared storage, as described.

Option A (High-Performance):Focuses on computation, not file consistency.

Option B (High-Availability):Ensures uptime, not shared file systems.

Option C (Failover):Switches to backups, not simultaneous access.

“Storage Clusters maintain a unified file system across nodes, supporting simultaneous access for data consistency and availability” (Module: Clustering Technologies, Section: Cluster Types).

Latency is the time delay between a request and the system’s response, directly matching the question’s description.

Option A (Reaction):Not a technical term for delay.

Option B (Durability):Refers to data persistence, not response time.

Option C (Nonrepudiation):Ensures actions can’t be denied, unrelated to delay.

“Latency measures the delay in system response to requests, a critical factor in assessing recovery and performance” (Module: System Resilience, Section: Performance Metrics).

Reparability refers to how easily technicians can fix or replace failing components, as described.

Option B (Recoverability):Ability to restore systems, not repair ease.

Option C (Robustness):Resilience, not repair-related.

Option D (Redundancy):Backup components, not repair ease.

“Reparability measures the ease of resolving or replacing failed components, critical for rapid system restoration” (Module: System Resilience, Section: Maintenance Concepts).

Detailed Awareness Training targets key BCP execution staff, providing in-depth knowledge of framework, processes, and strategies, as described.

Option B (Simulation):Hands-on practice, not framework-focused.

Option C (Scenario):Scenario-based, not comprehensive training.

Option D (Introductory):Basic overview, not detailed.

“Detailed Awareness Training equips key BCP personnel with deep understanding of processes and strategies for effective execution” (Module: Training and Awareness, Section: Training Types).

ISO 22301:2012 is the international standard for Business Continuity Management Systems (BCMS), specifying requirements for planning, implementing, and auditing a BCP to ensure it meets continuity objectives. An internal audit of a BCP would align with this standard.

Option B (ISO/IEC 27005:2011):Focuses on information security risk management, not BCP auditing.

Option C (ISO/IEC 27031:2011):Addresses ICT continuity, narrower than BCP.

Option D (ISO 22313):A guidance document for ISO 22301, not the auditable standard.

“ISO 22301:2012 defines the auditable framework for BCP, ensuring compliance and effectiveness through internal audits” (Module: Business Continuity Management, Section: Standards and Compliance).

Cloud Backup provides encrypted, secure data storage accessible anytime, anywhere via the internet, meeting the company’s needs.

Option A (Offsite):Offsite, but not necessarily accessible or encrypted by default.

Option C (Onsite):Local, not location-independent.

Option D (Hot Site):Recovery site, not a backup method.

“Cloud Backup ensures data security with encryption and offers ubiquitous access, ideal for flexible recovery needs” (Module: Data Backup and Recovery, Section: Cloud-Based Solutions).

OS-Based Virtualization (e.g., containerization) uses software like containers (Docker, LXC) or virtual engines to run multiple isolated instances on a single OS kernel, as described.

Option A (Data Virtualization):Abstracts data access, not container-based.

Option B (Network Virtualization):Virtualizes network resources, not OS-based.

Option C (Desktop Virtualization):Virtualizes desktops, not container-specific.

“OS-Based Virtualization leverages containers or virtual engines to isolate applications on a shared OS, enhancing efficiency” (Module: Virtualization and Recovery, Section: Virtualization Types).

Simulation Testing mimics a real-life disaster without disrupting operations, testing software, communication, procedures, and personnel in a controlled environment, as Amy did.

Option A (Walkthrough Testing):A tabletop review, not a live simulation.

Option B (Parallel Testing):Runs recovery systems alongside primary ones, not mimicking disasters.

Option C (Full Interruption):Shuts down primary systems, more invasive than described.

“Simulation Testing replicates disaster scenarios to evaluate software, communication, and personnel response without operational disruption” (Module: Testing Disaster Recovery Plans, Section: Test Types).

A Functional Test mobilizes resources to test specific BCP components in a live setting, as Archie did.

Option B (Simulation):Mimics scenarios, not resource mobilization.

Option C (Checklist):Reviews steps, not active testing.

Option D (Orientation):Introduces plan, not resource-based.

“Functional Tests activate resources to validate BCP components, ensuring operational readiness” (Module: Testing Disaster Recovery Plans, Section: Test Types).

The Open Virtualization Format (OVF) is a standard developed by the Distributed Management Task Force (DMTF) for packaging and distributing virtual machines and software. It ensures interoperability across virtualization platforms, making it a key virtualization standard.

Option A (PCI DSS):A security standard for payment cards, not virtualization-related.

Option B (CSA):An organization, not a standard, focused on cloud security.

Option C (vCloud API):A VMware-specific API, not a DMTF standard.

“The Open Virtualization Format (OVF), established by the DMTF, standardizes virtual machine packaging for portability and compatibility across platforms” (Module: Virtualization and Cloud Computing, Section: Virtualization Standards).

Business Impact Analysis (BIA) identifies critical resources, recovery order, and RTO/RPO, but assessing threat impact is part of risk assessment, not BIA’s primary objective.

Option B/C/D:Core BIA goals.

“BIA focuses on resource identification, recovery prioritization, and RTO/RPO, not direct threat impact assessment, which precedes it” (Module: Business Impact Analysis, Section: BIA Objectives).

A Hot Site is a fully operational alternate site with duplicated systems and data, running in parallel to the primary site. It allows immediate failover and continuity of operations with minimal downtime, meeting John’s need for near-instant resumption.

Option A (Cold Site):A basic facility with power and space, requiring significant setup time.

Option B (Warm Site):Partially equipped, with some pre-installed systems, but not fully operational in real time.

Option D (Colocation Facilities):Shared data centers, not inherently designed for immediate failover.

“Hot Sites are fully redundant, mirrored environments that operate concurrently with primary sites, ensuring zero to minimal downtime during failover, ideal for critical operations” (Module: Alternate Sites, Section: Site Types).

A Storage Area Network (SAN) is a high-speed network providing block-level access to consolidated storage, ideal for enterprise environments needing fast data transmission.

Option A (Cloud Storage):File-based, not block-level or high-speed focused.

Option B (NAS):File-level storage over a network, slower than SAN.

Option C (Storage Virtualization):Abstracts storage, not a transmission technique.

“SAN delivers high-speed, block-level storage access via a dedicated network, optimizing performance for critical applications” (Module: Storage Technologies, Section: SAN Overview).

Qualitative Risk Assessment evaluates risks based on subjective likelihood (e.g., “high,” “low”) and impact, without precise numerical values, fitting Seth’s high-level probability approach.

Option A (Quantitative):Uses numerical data (e.g., percentages), not applicable here.

Option C (Semi-Qualitative):A hybrid, but Seth’s method is fully qualitative.

Option D (Semi-Quantitative):Combines numbers with qualitative, not evident here.

“Qualitative Risk Assessment prioritizes risks using descriptive scales (e.g., high, low) for probability and impact, ideal for resource-constrained planning” (Module: Risk Management, Section: Assessment Types).

A Mobile Recovery Center is a portable, transportable unit that can be deployed anywhere as a temporary operating environment post-disaster.

Option B (Crisis Command):Centralized coordination, not mobile.

Option C (Cold Site):Fixed, basic facility.

Option D (Colocation):Shared fixed data center.

“Mobile Recovery Centers provide a movable operating environment, deployable on transportable units for flexible recovery” (Module: Alternate Sites, Section: Mobile Solutions).

Global Load Balancing routes traffic across geographically distributed servers (e.g., London to Mumbai) to optimize performance and handle server loss, as described.

Option A (High-Availability):Ensures uptime, not geographic routing.

Option C (Failover):Switches to a backup, not load distribution.

Option D (Network Load Balancing):Local load sharing, not global.

“Global Load Balancing distributes traffic across global servers, mitigating slowdowns from server loss by rerouting effectively” (Module: System Resilience, Section: Traffic Management).

An Exchange Server (Microsoft) provides mail and calendar services, managing email, scheduling, and collaboration.

Option A (Application Server):Runs applications, not mail-specific.

Option B (Web Server):Hosts websites, not mail/calendar.

Option D (Domain Controller):Manages network authentication, not mail.

“Exchange Servers deliver email and calendar services, critical for communication continuity in organizations” (Module: Server Management, Section: Server Roles).

A Disaster Management Plan identifies personnel for research, development, and implementation of disaster-related strategies, broader than just DR, as Jake did.

Option A (BCP):Focuses on continuity, not personnel identification alone.

Option C (IT Recovery):IT-specific, narrower scope.

Option D (DRP):Recovery-focused, not as broad as management.

“The Disaster Management Plan assigns personnel for research, development, and implementation, encompassing all disaster response aspects” (Module: Disaster Recovery Planning, Section: Management Plans).

A vulnerability assessment follows a logical sequence:

d) List the threats that may occur– Identify potential threats first.

b) Estimate the probability of occurrence of each threat– Assess likelihood next.

a) Assess the potential impact of the threat on the organization– Evaluate impact after probability.

c) Assess the internal and external resources available to mitigate the identified threats– Finally, review mitigation resources.This order (d, b, a, c) ensures threats are identified before analyzing their likelihood, impact, and mitigation, aligning with standard risk assessment practices.

Option A (c, a, d, b):Starts with resources, illogical without threats.

Option C (b, d, c, a):Probability before listing threats is premature.

Option D (b, c, d, a):Probability and resources before threats is out of sequence.

“Vulnerability assessment begins with listing threats, followed by estimating probability, assessing impact, and evaluating mitigation resources in that order (d, b, a, c)” (Module: Risk Management, Section: Vulnerability Assessment Steps).

Updating the NIC driver can resolve VMQ issues by improving how the NIC handles virtual machine data queues, addressing slow transmission due to restrictions.

Option A:Storage performance doesn’t directly fix VMQ/NIC issues.

Option B:Bandwidth increase helps but doesn’t target the root VMQ problem.

Option D:Incorrect, as updating the driver is a valid fix.

“Updating NIC drivers resolves VMQ bottlenecks, enhancing data transmission speed between virtual machines by optimizing hardware handling” (Module: Virtualization and Recovery, Section: VM Performance).

An Emergency Operations Center (EOC) is a centralized facility that coordinates disaster response, recovery actions, and resource allocation, ensuring operational coherence during a crisis.

Option A (Crisis Command Center):Similar but less formal/standardized than an EOC.

Option B (Colocation Facilities):Physical data centers, not command hubs.

Option C (Mobile Recovery Center):A portable recovery site, not a coordination center.

“The Emergency Operations Center (EOC) serves as the nerve center for disaster management, orchestrating recovery efforts and resource deployment” (Module: Disaster Recovery Planning, Section: Command and Control).

Polly estimated theImpact, which is the magnitude of damage (here, $200,000) resulting from a risk event (data leak). This drove her decision to upgrade, comparing it to the cost.

Option B (Hazard):A potential source of harm, not the damage estimate.

Option C (Likelihood):Probability of occurrence, not addressed here.

Option D (Vulnerability):Weakness (vulnerable server), not the damage itself.

“Impact, the estimated magnitude of loss from a risk event, such as a data leak costing $200,000, guides mitigation decisions in risk assessment” (Module: Risk Management, Section: Risk Factors).

Load Balancing distributes web traffic across multiple servers (Zoe’s three) to optimize performance and prevent overload, as described.

Option A (Point in Time Recovery):Restores data, not traffic management.

Option C (Clustering):Groups servers for redundancy, not load distribution alone.

Option D (High-Availability):Ensures uptime, not necessarily load balancing.

“Load Balancing evenly distributes traffic across servers, enhancing efficiency and preventing crashes under high demand” (Module: System Resilience, Section: Traffic Management).

A Software Defined Data Center (SDDC) is a fully virtualized infrastructure where storage, compute, and networking are abstracted and delivered as a service, aligning with the question’s description. It encompasses more than just storage, including processing capabilities.

Option A (Cloud-based Storage):Refers only to storage, not a full facility with processing.

Option B (Virtual Machines):Individual virtualized servers, not a complete facility.

Option D (Data Virtualization):Focuses on abstracting data access, not a full service facility.

EDRP v3 covers SDDC as an advanced virtualization concept for disaster recovery and service delivery (Module: Virtualization and Cloud Computing).

Risk Valuation assesses risk likelihood and impact (e.g., failure percentages), as Remy did by evaluating fire safety’s effect on investment risk.

Option A (RORAC):Financial return metric, not risk evaluation.

Option B (Value at Risk):Quantifies loss potential, not likelihood shift.

Option C (RAROC):Adjusts returns for risk, not direct evaluation.

“Risk Valuation estimates the probability and impact of risks, such as facility vulnerabilities, to inform investment decisions” (Module: Risk Management, Section: Risk Evaluation Methods).