88. The most effective action to be taken when a hurricane advance warning is provided is to:
a. Declare the disaster early.
b. Install an uninterruptible power supply system.
c. Provide a backup water source.
d. Acquire gasoline-powered pumps.
88. a. The first thing is to declare the disaster as soon as the warning sign is known. Protecting the business site is instrumental in continuing or restoring operations in the event of a hurricane. Ways to do this include an uninterruptible power supply (batteries and generators), a backup water source, and a supply of gasoline-powered pumps to keep the lower levels of the facility clear of floodwaters. Boarding up windows and doors is good to protect buildings from high-speed flying debris and to prevent looting.
89. Which of the following requires advance planning to handle a real flood-driven disaster?
a. Call tree list, power requirements, and air-conditioning requirements
b. Power requirements and air-conditioning requirements
c. Air-conditioning requirements and media communications
d. Call tree list and media communications
89. b. Power and air-conditioning requirements need to be determined in advance to reduce the installation time frames. This includes diesel power generators, fuel, and other associated equipment. Media communications include keeping in touch with radio, television, and newspaper firms. The call tree list should be kept current all the time so that the employee and vendor-notification process can begin as soon as the disaster strikes. This list includes primary and secondary employee names and phone numbers as well as escalation levels.
90. Which of the following is of least concern in a local-area network contingency plan?
a. Application systems are scheduled for recovery based on their priorities.
b. Application systems are scheduled for recovery based on the urgency of the information.
c. Application systems are scheduled for recovery based on a period of downtime acceptable to the application users.
d. Application systems are scheduled for recovery based on a period of downtime tolerable to the application programmers.
90. d. An alternative location is needed to ensure that critical applications can continue to be processed when the local-area network (LAN) is unavailable for an extended period of time. Application systems should be scheduled for recovery and operation at the alternative site, based on their priority, the urgency of the information, and the period of downtime considered acceptable by the application users. It does not matter what the application programmers consider acceptable because they are not the direct users of the system.
91. After a disaster, at what stage should application systems be recovered?
a. To the last online transaction completed
b. To the last batch processing prior to interruption
c. To the actual point of interruption
d. To the last master file update prior to interruption
91. c. The goal is to capture all data points necessary to restart a system without loss of any data in the work-in-progress status. The recovery team should recover all application systems to the actual point of the interruption. The other three choices are incorrect because there could be a delay in processing or posting data into master files or databases depending on their schedules.
92. Which of the following may not reduce the recovery time after a disaster strikes?
a. Writing recovery scripts
b. Performing rigorous testing
c. Refining the recovery plans
d. Documenting the recovery plans
92. d. Documenting the recovery plan should be done first and be available to use during a recovery as a guidance. The amount of time and effort in developing the plan has no bearing on the real recovery from a disaster. On the other hand, the amount of time and effort spent on the other three choices and the degree of perfection attained in those three choices will definitely help in reducing the recovery time after a disaster strikes. The more time spent on these three choices, the better the quality of the plan. The key point is that documenting the recovery plan alone is not enough because it is a paper exercise, showing guidance. The real benefit comes from careful implementation of that plan in actions.
93. An organization’s effective presentation of disaster scenarios should be based on which of the following?
a. Severity and timing levels
b. Risk and impact levels
c. Cost and timing levels
d. Event and incident levels
93. a. The disaster scenarios, describing the types of incidents that an organization is likely to experience, should be based on events or situations that are severe in magnitude (high in damages and longer in outages), occurring at the worst possible time (i.e., worst-case scenario with pessimistic time), resulting in severe impairment to the organization’s ability to conduct and/or continue its business operations.
The planning horizon for these scenarios include short-term (i.e., less than one month outage) and long-term (i.e., more than three month outage), the severity magnitude levels include low, moderate, and high; and the timing levels include worst possible time, most likely time, and least likely time. The combination of high severity level and the worst possible time is an example of high-risk scenario. The other three choices are incorrect because they are not relevant directly to the disaster scenarios in terms of severity and timing levels except that they support the severity and timing levels indirectly.
94. The focus of disaster recovery planning should be on:
a. Protecting the organization against the consequences of a disaster
b. Probability that a disaster may or may not happen
c. Balancing the cost of recovery planning against the probability that a disaster might actually happen
d. Selecting the best alternative backup processing facilities
94. a. The focus of disaster recovery planning should be on protecting the organization against the consequences of a disaster, not on the probability that it may or may not happen.
95. Which of the following statements is not true about the critical application categories established for disaster recovery planning purposes?
a. Predefined categories need not be followed during a disaster because time is short.
b. Each category has a defined time frame to recover.
c. Each category has a priority level assigned to it.
d. The highest level category is the last one to recover.
95. a. It is important to define applications into certain categories to establish processing priority. For example, the time for recovery of applications in category I could be less than 8 hours after disaster declaration (high priority). The time frame for recovery of category IV applications could be less than 12 hours after disaster declaration (low priority).