Читаем CISSP Practice полностью

7. d. System 4 has the highest availability percentage. Theoretically speaking, the lower the downtime for a system, the higher the availability of that system, and higher the reliability of that system, and vice versa. In fact, this question does not require any calculations to perform because one can find out the correct answer just by looking at the downtime and uptime data given in that the lower the downtime hours, the higher the uptime hours, and the higher the availability of the system, and vice versa. System Availability, percent Reliability, percent 1 97.7 97.7 2 98.3 98.3 3 97.1 97.1 4 98.9 98.9

Calculations for System 1 are shown below and calculations for other systems follow the System 1 calculations.

Availability for System 1 =

[Uptime/(Uptime + Downtime)] × 100 = [(8,560/8,760)] × 100 = 97.7%

Reliability for System 1 =

[1 − (Downtime/Downtime + Uptime)] × 100 = [1 − (200/8,760)] × 100 = 97.7%

Check: Reliability for System 1 =

100 − (100 − Availability percent) = 100 − (100 − 97.7) = 97.7%

This goes to say that the availability and reliability goals are intrinsically related to each other, where the former is a component of the latter.

8. Regarding BCP and DRP, redundant array of independent disk (RAID) does not do which of the following?

a. Provide disk redundancy

b. Provide power redundancy

c. Decrease mean-time-between-failures

d. Provide fault tolerance for data storage

8. b. Redundant array of independent disk (RAID) does not provide power redundancy and should be acquired through an uninterruptible power supply system. However, RAID provides the other three choices.

9. Redundant array of independent disk (RAID) technology does not use which of the following?

a. Electronic vaulting

b. Mirroring

c. Parity

d. Striping

9. a. Redundant array of independent disk (RAID) technology uses three data redundancy techniques such as mirroring, parity, and striping, not electronic vaulting. Electronic vaulting is located offsite, whereas RAID is placed at local servers where the former may use the latter.

10. Regarding BCP and DRP, the board of directors of an organization is not required to follow which of the following?

a. Duty of due care

b. Duty of absolute care

c. Duty of loyalty

d. Duty of obedience

10. b. Duty of absolute care is not needed because reasonable and normal care is expected of the board of directors because no one can anticipate or protect from all disasters. However, the directors need to follow the other three duties of due care, loyalty, and obedience.

11. Which of the following tasks is not a part of business continuity plan (BCP)?

a. Project scoping

b. Impact assessment

c. Disaster recovery procedures

d. Disaster recovery strategies

11. c. Tasks are different between a business continuity plan (BCP) and disaster recovery planning (DRP) because of timing of those tasks. For example, disaster recovery procedures come into play only during disaster, which is a part of DRP.

12. Which of the following tasks is not a part of disaster recovery planning (DRP)?

a. Restoration procedures

b. Procuring the needed equipment

c. Relocating to a primary processing site

d. Selecting an alternate processing site

12. d. Tasks are different between business continuity plan (BCP) and disaster recovery planning (DRP) because of timing of those tasks. For example, selecting an alternative processing site should be planned out prior to a disaster, which is a part of a BCP. The other three choices are a part of DRP. Note that DRP is associated with data processing and BCP refers to actions that keep the business running in the event of a disruption, even if it is with pencil and paper.

13. Regarding BCP and DRP, critical measurements in business impact analysis (BIA) include which of the following?

a. General support system objectives

b. Major application system objectives

c. Recovery time objectives and recovery point objectives

d. Uninterruptible power supply system objectives