Study Hub / ISC2 Certified in Cybersecurity (CC) / Domain 2.0
ISC2 Certified in Cybersecurity (CC) Domain 2.0: Business Continuity, Disaster Recovery & Incident Response — Explained
Domain 2.0 is about surviving the bad day: keeping the business running through disruption (continuity), restoring technology afterward (recovery), and responding to security incidents with a practiced process.
Business continuity and disaster recovery
- BCP (business continuity plan) — keeps the business running during disruption: alternate sites, manual workarounds, who does what. Business-first.
- DRP (disaster recovery plan) — restores the technology: systems, data, networks. IT-first. DRP supports BCP.
- BIA (business impact analysis) — the analysis that precedes both plans: which processes are critical, what downtime costs, and therefore what RTO/RPO each system gets.
- RTO / RPO — how fast must we recover (time) vs. how much data can we lose (point). Shorter = more expensive; the business signs off on the tradeoff.
- Testing — plans rot. Tabletop exercises (talk through it), failover tests (actually switch), and full simulations keep the plan honest.
Recovery targets and sites
- RTO (recovery time objective) — how long you can be down. "Email must be back within 4 hours" — RTO is a duration.
- RPO (recovery point objective) — how much data you can afford to lose. "No more than 1 hour of transactions" — RPO is measured in time-behind, and it dictates backup frequency.
- The pair drives design — RTO 4h/RPO 1h means: restore capability within 4 hours, backups at least hourly. Tighter objectives cost more — the BIA justifies the spend.
- Recovery sites — hot (fully equipped, minutes to fail over — most expensive), warm (hardware ready, data/config needed — hours), cold (empty space — days, cheapest). Match the site to the RTO.
- Backups — full (everything, slowest), incremental (changes since last backup of any kind — fast backup, slow restore), differential (changes since last full — middle ground). Test restores: an untested backup is a rumor.
Incident response concepts
- Why process matters — incidents are stressful, and stressed people improvise badly. A practiced response process turns panic into procedure.
- The lifecycle (concept level) — preparation (plans, roles, tools — decided before anything happens), detection & analysis (confirm and scope: what, where, how far), containment (stop the spread without destroying evidence), eradication (remove the cause), recovery (restore from known-good), lessons learned (blameless review, action items).
- Key distinctions — an event is anything observable; an incident is an event with negative security impact. Triage decides which is which.
- Roles — who declares an incident, who communicates (internally and externally), who has authority to take systems offline. Decided in the plan, not during the crisis.
- Evidence awareness — responders preserve logs and system state for later analysis; the response team's notes become the incident record.
The must-memorize table: governance documents
Four documents, one hierarchy.
| Document | Answers | Mandatory? |
|---|---|---|
| Policy | "What must be done and why?" | Yes — management mandate |
| Standard | "Exactly how, technically?" | Yes — implements the policy |
| Procedure | "Step by step, how do I do it?" | Yes — for the task at hand |
| Guideline | "What's recommended?" | No — advisory only |
| Baseline | "What's the minimum bar?" | Yes — floor for a system class |
Try it: 4 sample questions
Sample questions to check your understanding of this domain. Answers and full reasoning are tucked under each one.
1. A company’s email system has an RTO of 4 hours and an RPO of 1 hour. What do these require?
- A. A. Email must never go down
- B. B. Restore within 4 hours of an outage, and lose no more than 1 hour of email data — which means hourly (or better) backups
- C. C. Backups every 4 hours, restore within 1 hour
- D. D. Four hours of downtime per week is acceptable
Show answer & reasoning
B. RTO is the downtime allowance (back within 4h); RPO is the data-loss allowance (≤1h behind → backups at least hourly). Swapping them (C) is the classic confusion — read which letter is which: T=time down, P=point (data) behind.
2. Before writing its disaster recovery plan, a company analyzes which business processes are critical and what downtime costs per hour. What is this analysis called?
- A. A. A penetration test
- B. B. A business impact analysis (BIA)
- C. C. A vulnerability scan
- D. D. A risk acceptance
Show answer & reasoning
B. The BIA identifies critical processes and quantifies impact — and it comes before the BCP/DRP, because the plans' RTO/RPO targets derive from it. You can't plan recovery sensibly without knowing what matters most and what it costs to lose.
3. A trading firm needs failover within minutes of a site loss, cost is secondary. Which recovery site type fits?
- A. A. Cold site
- B. B. Hot site — fully equipped and ready, failover in minutes
- C. C. Warm site
- D. D. No site — backups are enough
Show answer & reasoning
B. Hot = ready now (minutes), warm = hours, cold = days. The RTO (minutes) selects the site type; the budget just has to accept it. Backups alone (D) restore data, not a running site — recovery needs both.
4. During a suspected breach, the team isolates affected hosts before investigating the cause. Which incident response phase is this, and why this order?
- A. A. Eradication — remove the attacker first
- B. B. Containment — stop the spread first; investigating an uncontained incident lets damage continue
- C. C. Recovery — restore service first
- D. D. Lessons learned
Show answer & reasoning
B. Containment comes before deep investigation: you stop the bleeding, then diagnose. Investigating first while the attacker keeps moving is analysis during an active fire. (And containment preserves evidence — unlike wiping, which destroys it.)
This was one domain. The simulator drills all 5.
This free preview covered Business Continuity, Disaster Recovery & Incident Response (Domain 2.0, 10%). Not covered here: Access Controls Concepts (Domain 3.0, 22%); Network Security (Domain 4.0, 24%). The two most technical domains — access control models and network security — stay in the paid guide and practice bank. The ByteBar Practice Exam Simulator drills every domain with 1,000 exam-style questions — $9.99 one-time unlocks all 28 exams. Prefer to read? The full ISC2 CC Study Guide is in the ByteBar shop on Etsy.
Practice Exam Simulator — $9.99 one-time, all 28 exams Full Study Guides on Etsy