Remote journaling means that a transaction log file, not the file itself, is sent remotely. A transaction is one or more update operations performed on a file. In other words, it is a history of updates to a file. This means that if the original file is lost, it can be reconstructed from the transaction log.

Disaster Recovery Planning (DRP) is the process of creating short-term plans, policies, procedures, and tools to enable the recovery or continuation of critical IT systems in the event of a disaster. It focuses on the IT systems that support critical business functions and how they will be restored after a disaster. For example, it considers what to do if you suffer a distributed denial of service (DDOS) attack, if your servers are compromised, if there is a power outage, etc. BCP is more focused on what should happen and does not necessarily include system requirements.

〇：Differential Backup

Backups can be taken in full, differential, or incremental. Most files are not changed daily to save very much time and resources, and it is better to develop a backup plan that does not back up for data that is not continually changing. In backup software, when a file is modified or created, the file system sets the archive bit and the backup software determines if that file should be backed up. A differential backup backs up files that have changed since the last full backup.

×：Incremental Backup

An incremental backup backs up all data that has changed since the last backup.

×：Full Backup

A full backup backs up the entire database or the entire system.

×：Partial Backup

Not in the backup category.

〇：Salvage Teams

The BCP coordinator should understand the needs of the company and the types of teams that need to be developed and trained. Employees should be assigned to specific teams based on their knowledge and skill sets. Named leaders, each team must have members and the ability to direct their activities. These team leaders will be responsible not only for ensuring that team goals are met, but also for interacting with each other to ensure that each team is operating properly. The salvage team is responsible for initiating recovery of the original site. They are also responsible for backing up data from the alternate site and restoring it within the new facility, carefully terminating any unforeseen operations, and ensuring equipment and personnel are transported to the new facility.

×：Damage Assessment Team

The Damage Assessment Team is incorrect because it is responsible for determining the extent and severity of damage.

×：BCP Team

Wrong because the BCP team is responsible for creating and maintaining a business continuity plan.

×：Recovery Team

Wrong because the Recovery Team is responsible for getting an alternate site to work and to keep the environment functioning.

Disk mirroring means writing the same data to multiple hard disks; a RAID (Redundant Array of Independent Disks) controller must write all data twice, requiring at least two disks. Disk striping can also be provided when parity is used, but disk striping alone cannot provide redundancy.

〇：Restore the virus unpatched file version from the backup media.

The best practice is to install an unpatched, uninfected version of the file from the backup media. It is important to restore files that are known to be clean, as attempts to remove the files may corrupt them. The most important thing is not to spread the impact, but attempting to unilaterally delete files may make them unavailable for later investigation.

×：Replace the file with the file saved the previous day.

The file saved the previous day may also contain the virus.

×：Delete the file and contact the vendor.

This is an incorrect answer because the condition of this question is that if the file is deleted, the normal file content itself may be damaged.

×：Back up the data and delete the file.

This is an incorrect answer because backing up the data that contains the virus and deleting the file does not result in a clean situation.

〇：Continuity of Operations Plan

A continuity of operations plan (COOP) establishes senior management and post-disaster headquarters. It also outlines roles and authorities and individual role tasks.Creating a COOP begins with an assessment of how the organization operates to identify mission-critical staff, resources, procedures, and equipment. Suppliers, partners, and contractors identify other companies with whom they routinely interact and create a list of these companies. Therefore, the correct answer is the Continuity of Operations Plan.

×：Cyber Incident Response Plan

Cyber Incident Recovery is a plan for recovery from a cyber attack.

×：Crew Emergency Plan

A Crew Emergency Plan is a plan for the smooth transition of a facility’s staff to a secure environment.

×：IT Contingency Plan

A contingency plan is a plan that outlines the measures to be taken in the event of an accident, disaster, or other emergency.

RPO (Recovery Point Objective) is the target value for recovering data at a point in the past when a failure occurs. When a failure occurs, the data currently handled is lost. The lost data must be recovered from backups, but it is important to know how far in the past the backups are from the current point in time.

RTO (Recovery Time Objective) is a target value that defines when the data should be recovered in the event of a failure. In the event of a failure, the service must not be unavailable indefinitely. Failure response procedures and disaster drills must be implemented to establish a target value for the time from the occurrence of a failure to the startup of service.

MTD represents the time it takes to signify severe and irreparable damage to the reputation and bottom line of an organization; RTO values are smaller than MTD values; RTO assumes that there is a period of acceptable downtime.

Disaster Recovery Planning includes the Mitigation, Preparedness, Response, and Recovery life cycles.

• Mitigation: Reduces the impact and likelihood of a disaster.
• Prepare: Create programs, procedures, and tools for response.
• Response: follow procedures and how to respond to a disaster.
• Recovery: re-establish basic functionality and return to a full production environment.

〇：Declare the impact and consequences of the disaster.

The final step in the damage assessment is to declare the disaster. After the information from the damage assessment has been collected and evaluated, determine if the BCP actually needs to be activated. The BCP coordinator and team should determine the activation criteria before the disaster occurs.

×：Determine the cause of the disaster.

Determining the cause of the disaster is incorrect as it is the first step in the damage assessment process.

×：Identify resources that need to be replaced immediately.

Incorrect because identifying resources that need to be replaced immediately is not the last step in damage assessment.

×：Determine how long it will take to bring critical functions back online.

Incorrect because determining how long it will take to bring critical functions back online is the second-to-last step in damage assessment.

〇：Can be the cheapest of the off-site options, but can create many security problems due to mixed operations.

Reciprocal agreements, also called mutual aid, mean that Company A agrees to allow Company B to use its facilities if Company B suffers a disaster, and vice versa. While this is a less expensive way to move than other off-site alternatives, it is not always the best choice. In most environments, the facility has reached its limits regarding the use of space, resources, and computing power. To allow different firms to come in and operate out of the same store could be detrimental to both firms. The stress of both companies working in the same environment can cause tremendous levels of tension. If that did not work out, it would provide the only short-term solution. Configuration management could be a nightmare, and mixing operations could result in many security problems. Reciprocal agreements have been known to work well for certain companies, such as newsprint. These firms require very specific technology and equipment that is not available through any subscription service. For most other organizations, reciprocity agreements are, at best, generally a secondary option for disaster protection.

×：Fully set up and ready to operate within a few hours is the most expensive of the off-site options.

This is a description of a hot site.

×：Inexpensive option, but takes the most time and effort to get up and running after a disaster.

Explanation for cold sites.

×：A good alternative for companies that rely on proprietary software, but regular annual testing is usually not available.

This is incorrect as it describes with respect to companies that depend on proprietary software. Having proprietary software in a shared space with other vendors is basically undesirable from the standpoint of license agreements involved.

Greenfield is undeveloped land that has not yet been built upon. The perspectives for selecting a site as a data center site include topography, utilities, and public safety.

• Topography refers to the physical shape of the landscape-hills, valleys, trees, streams.
• Utility refers to the degree to which power and internet in the area are reliable.
• Public safety is in terms of how high is the crime rate in the area and how close is the police force.

〇：Information used to reconstruct data

RAID can improve system performance by providing fault tolerance to the hard drive and the data it holds. Redundancy and speed are provided by splitting the data and writing it to multiple disks, allowing different disk heads to operate simultaneously to retrieve the requested information. Control data is also distributed across each disk. This is called parity, and if one disk fails, the other disks can work together to recover the data.

×：Information used to create new data

This is incorrect because parity information is not used to create new data, but rather as instructions on how to recreate lost or corrupted data.

×：Information used to erase data

Parity information is not used to erase data. This is incorrect because it is used as instructions on how to recreate lost or corrupted data.

×：Information used to construct data

Parity information is not used to create data. Incorrect because it is used as instructions on how to recreate lost or corrupted data.

〇：Clustering

Clustering is a fault-tolerant server technology in which servers are redundantly analogous. A server cluster is a group of servers that can be logically interpreted by users as one server and managed as a single logical system. Clustering provides availability and scalability. It helps to provide immunity to this group, physically distinct systems and failure and improved performance.

The problem statement is phrased in a difficult sentence. It would be difficult to derive the exact specific words from the phrase “logically coupled with a physically distinct group of systems.” In such questions, it is useful to use a process of elimination to derive options from the words that would be the point of the question. From the latter part, “technology that helps provide immunity to failure while also helping with scalability,” we can see that it is something that is both fault-tolerant and scalable. Fault tolerance alone does not narrow down the choices, but in terms of scalability features, clustering falls into this category. Therefore, the correct answer is “clustering.

×：Disk dupe

There is no such term. When presented with a seemingly incomprehensible sentence, you may consider the possibility that it is a word you probably do not know, given the time limit.

×：RAID

RAID (Redundant Array of Independent/Inexpensive Disks) is a technology for operating multiple hard disks as a single hard disk. It has a mechanism to improve physical redundancy by how the data to be recorded is written to the hard disks. This is not a technology system that ensures scalability.

×：Virtualization

Virtualization is a technology that makes it appear as if multiple operating systems are running on the system. Or, it is an environment that enables the construction of a real environment through simulation-like operations surrounding them. While virtualized environments allow for the construction of environments that provide fault tolerance and scalability, they do not match the operation of logically combining them with physically different groups of systems.

〇：SIEM

Many organizations have implemented security event management systems, called Security Information and Event Management (SIEM) systems. They attempt to correlate log data collected from various devices (servers, firewalls, routers, etc.) and provide analysis capabilities. They also have solutions with networks (IDS, IPS, anti-malware, proxies, etc.) that collect logs in various proprietary formats that require centralization, standardization, and normalization. Therefore, the correct answer is SIEM.

×：Intrusion Detection System

Intrusion Detection System (IDS, Intrusion Detection System) is a mechanism that monitors the system and leads to passive actions. It does not have the ability to collect and analyze logs.

×：SOAR

SOAR (Security Orchestration, Automation and Response) is a technology that enables efficient monitoring, understanding, decision-making and action on security incidents. It may be fulfilled by SOAR through intrinsic cause analysis, but it is not a solution used for the purpose of identifying if suspicious activity is taking place in the network.

×：Event correlation tools

The term “event correlation tool” does not exist, but may be a feature of a SIEM.

〇：RAID Level 3

RAID redundant arrays provide fault tolerance capability for hard drives and can improve system performance. Redundancy and speed are provided by splitting data and writing it to multiple disks, allowing different disk heads to operate simultaneously to retrieve requested information. At this time, recovery data is also created. This is called parity; if one disk fails, the parity data can be used to reconstruct the corrupted or lost information. Different levels of RAID systems experience different activities that provide fault tolerance or improved performance. RAID level 3 is a method that uses byte-level striping and dedicated parity disks.

×：RAID Level 0

Wrong because only striping occurs at level 0.

×：RAID Level 5

RAID 5 is incorrect because it uses block-level striping and interleaved parity on all disks.

×：RAID Level 10

Level 10 is incorrect because it is associated with striping and mirroring.

〇：A change unanimously approved by the change control committee would be a step that does not require testing of the actual equipment.

This is a false choice question.

For different types of environmental changes, a structured change management process needs to be in place. Depending on the severity of the change requirement, the change and implementation may need to be presented to a change control committee. Change requests approved by the change control committee must be tested to discover any unintended consequences. This helps to demonstrate the purpose, consequences, and possible effects of the change in its various aspects. This means that just because a change has been approved by the change control board does not mean that it does not need to be tested. The change control board has mandated action on the change, and its appropriateness must be ensured by testing. Therefore, the correct answer is: “A change that is unanimously approved by the change control committee is a step that does not require testing on the actual equipment.” The result will be

×：Changes approved by the change control committee should be kept as a log of changes.

This is correct change management.

×：A rough schedule should be created during the planning phase of the change.

This is correct change management.

×：Proposed changes should be prioritized and reviewed.

This is correct change management.

〇：Send a report labeled “No output”.

If there is nothing to report (nothing to report), you need to make sure the manager is aware that the report has no information and is not only to be held accountable.

×：Send an email notifying the manager that there is nothing to report.

It is not appropriate to suddenly keep a record of the report by e-mail, since the report is normally scheduled to be reported in the operation. Realistically, wouldn’t you be more endearing to your manager if you communicated with him or her every step of the way? No, I am not asking you to do that.

×：Re-submit last week’s report and submit the date of last week’s report as this week’s date.

Delivering last week’s report does not express that nothing was reported this week.

×：Nothing.

You are required to report that nothing happened.