PBQ — Business Continuity & DR Plan

A ransomware attack has encrypted Acme Corp's primary data center. The CISO must invoke the DR plan. The company has strict constraints: annual IT budget of $2M, a contractual SLA requiring systems restore within 4 hours, and the last verified backup is from 6 hours ago. You must: (1) order the 8 DR activation steps correctly, (2) select the appropriate RTO/RPO targets and DR site tier, and (3) answer the cost vs. recovery trade-off questions.

🗃️ DR Steps — drag to order

📋 DR Activation Order (1 = first action)

⏱️ Recovery Targets

Recovery Time Objective (RTO) Max acceptable downtime for this SLA

Recovery Point Objective (RPO) Max acceptable data loss

Backup frequency needed to meet RPO How often must backups run going forward?

🏢 DR Site Selection

Appropriate DR site tier given 4-hour RTO + $2M budget Hot = always-on mirror | Warm = partially ready | Cold = empty shell

Why NOT a hot site for Acme Corp? Select the most accurate reason

⚖️ Part 3 — Cost vs. Recovery Trade-offs

Q1. After the ransomware incident, the CISO wants to pay the ransom to recover faster. The security team recommends against it. What is the primary security reason?

Paying the ransom is illegal in all jurisdictions. Paying funds criminal organizations, provides no guarantee of key delivery, and signals willingness to pay — increasing likelihood of future attacks on the same organization. Decryption tools provided by attackers always contain backdoors. Payment traceable via blockchain makes prosecution easy, so attackers won't provide keys.

Q2. The 6-hour-old backup means up to 6 hours of transaction data is lost. What technology, if implemented beforehand, would have reduced the RPO to near-zero?

Full daily backups stored offsite on tape. Continuous data protection (CDP) / synchronous replication to a secondary site — captures every write in real time. Incremental backups every 4 hours. RAID 5 storage redundancy at the primary site.

Q3. Before restoring from backup, what is the most critical step to prevent immediate re-infection?

Change all user passwords before restoration. Completely isolate and re-image all affected systems, identify and close the initial attack vector (e.g., the phishing entry point or vulnerable service), then restore from a verified clean backup. Run antivirus on the backup files before restoring. Restore the backup immediately — speed of recovery takes priority over re-infection risk during active incident.

Business Continuity & Disaster Recovery — Trade-off Decisions