Domain 2: Security Governance

Business continuity planning, disaster recovery strategies, and incident response fundamentals.

5 minutes 5 Questions

Domain 2 of the ISC2 Certified in Cybersecurity (CC) certification focuses on Business Continuity (BC), Disaster Recovery (DR), and Incident Response (IR) concepts, which are critical frameworks for organizational resilience against disruptions. **Business Continuity (BC)** ensures that essential …

Concepts covered
Business Continuity Planning ComponentsBusiness Impact AnalysisDisaster Recovery Purpose and ImportanceBusiness Continuity Purpose and ImportanceDisaster Recovery Planning ComponentsRecovery Point and Recovery Time ObjectivesDisaster Recovery Sites and StrategiesSecurity Awareness Training ProgramsSocial Engineering AwarenessGovernance, Risk, and Compliance (GRC) FundamentalsSecurity Metrics, KRIs, and Reporting
Test mode:
Start practice test

CC - Domain 2: Security Governance Example Questions

Test your knowledge of Domain 2: Security Governance

Question 1

In disaster recovery planning, what does the term 'call tree' refer to?

Correct Answer: A structured notification chain used to contact personnel during a disaster event

A call tree is a structured notification chain that defines who contacts whom in a specific order to quickly disseminate critical information to all necessary personnel during a disaster or emergency event, ensuring rapid and organized communication.

The hierarchical diagram of system restoration priority describes a recovery priority list or business impact analysis output, not a call tree. The documented escalation path for regulatory reporting refers to an incident response communication plan for external stakeholders. The decision flowchart for selecting recovery strategies describes a decision tree or recovery procedure guide.

The key concept tested is understanding communication tools and personnel notification procedures within disaster recovery planning.

Question 2

A company conducts its first full-interruption test of the BCP. The test reveals that while IT systems recover on schedule, employees are confused about their roles and several teams report to the wrong recovery location. Management asks which BCP component should be revised to address these issues. Which component most needs improvement?

Correct Answer: The personnel notification and response procedures that outline roles, responsibilities, and reporting locations for staff during a disruption

The correct answer addresses the exact problems identified: employees were confused about their roles and reported to wrong recovery locations, which are directly governed by personnel notification and response procedures that define roles, responsibilities, and reporting locations.

Recovery time objectives and technical restoration procedures are not the issue since IT systems recovered on schedule. The business impact analysis is an analytical document that identifies critical functions but does not direct personnel actions during a disruption. The alternate site provisioning plan deals with hardware and infrastructure at recovery sites, not with directing people to the correct locations or clarifying their duties.

The key concept tested is understanding BCP personnel notification and response planning as distinct from technical recovery components.

Question 3

In the context of security awareness program maturity models, what does the transition from a 'compliance-focused' stage to a 'behavior-change' stage fundamentally require?

Correct Answer: Integration of continuous behavioral metrics and adaptive content delivery tied to observed risk indicators

The transition from compliance-focused to behavior-change requires continuous behavioral metrics and adaptive content delivery tied to observed risk indicators because this approach shifts the focus from merely checking boxes to actually measuring and influencing how people behave in real-world security scenarios.

Annual compliance assessments remain stuck in the compliance-focused stage by design. Periodic knowledge assessments with role-specific content represent incremental improvement but still focus on knowledge rather than behavior. Quarterly phishing simulations are a useful tool but remain calendar-driven rather than risk-adaptive, which keeps the program in a compliance mindset.

The key concept tested is security awareness program maturity, specifically the shift from static compliance activities to dynamic, metrics-driven behavioral change initiatives.

More Domain 2: Security Governance questions
734 questions (total)
Practice 100 questions
One session at a time, always new questions