Domain 2 of 5 · Chapter 2 of 4

Understand Redundancy and Business Resilience

Unlock the complete study guide + 12 practice exams totaling 1,500 questions.

Bundled into the existing Certified in Cybersecurity premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

  • Three jobs: redundancy, continuity and recovery
  • Business impact analysis and recovery objectives
  • Redundancy, failover and single points of failure
  • Business continuity measures: work, people, messages
  • Backup methods: full, incremental and differential
  • Keeping backups safe and usable
  • Alternate sites: readiness, providers and location
  • AI services in continuity and recovery
  • Running the plan: activation to reconstitution
  • Testing, training and exercises
  • Keeping the plan current and reachable

Redundancy and failover vs business continuity vs disaster recovery

AspectRedundancy and failoverBusiness continuity (BC)Disaster recovery (DR)
Question it answersHow does service survive one failed component?How does the business process keep working during the disruption?How are systems and data brought back?
What it protectsAvailability of a system or serviceBusiness processes, with their people and facilitiesInformation systems, data and supporting facilities
Typical measuresDuplicate servers, failover, UPS and generatorManual workarounds, alternate personnel, crisis communicationsBackups, alternate sites, recovery procedures
Time measure it servesKeeps a single failure from causing downtimeKeeps the total outage within the MTDMeets the RTO and the RPO
What it cannot replaceBackups, because replicas copy corruptionRestoring the failed systemsContinuity of work that does not depend on IT

Decision tree

Is the primary facilitystill usable?Restore in placefrom backupsYesNoShort RTO: quick takeoverat another site needed?Hot siteequipment and support readyYesNoDoes the RTO allow time toobtain and install equipment?Cold sitespace and power, no equipmentYesNoWarm sitepartly equipped, finish setupAlways: away from the primary site's hazards, with tested backups it can read
Cheat sheet

Cheat sheet

  • Business continuity sustains business processes while disaster recovery restores systems
  • A business impact analysis establishes recovery priorities from disruption impacts
  • The recovery time objective limits acceptable system unavailability
  • The recovery point objective expresses how much recent data loss is tolerable
  • Maximum tolerable downtime applies to the total business-process interruption
  • Continuity planning needs the people who own and perform the affected work
  • Approved manual workarounds can sustain business activity during an outage
  • Redundancy and failover reduce service interruption after a component fails
  • Redundant components can still depend on the same point of failure
  • A UPS covers short power interruptions while a generator supports longer outages
  • A hot site provides a highly prepared alternate processing environment
  • A warm site trades some recovery speed for lower readiness cost
  • A cold site supplies facilities but requires computing equipment before recovery
  • Alternate sites should not share the primary site's disaster exposure
  • A reciprocal recovery agreement requires spare capacity and compatible systems
  • Backups preserve recovery copies that live redundancy cannot replace
  • A full backup copies all data within its selected scope
  • Incremental backups retain changes since the preceding backup
  • Differential backups retain changes since the last full backup
  • Offline backups reduce ransomware's access to recovery copies
  • Encrypted backups require recoverable keys as well as intact media
  • AI recovery planning includes service configurations and supporting datasets
  • Restoration tests verify that backups can actually support recovery
  • A tabletop exercise tests coordination through discussion
  • Functional recovery exercises demonstrate operational capability
  • Continuity plans must stay aligned with systems, personnel, and lessons learned
  • Recovery plans specify when to activate and whom to notify
  • Recovery readiness includes alternate personnel for unavailable team members
  • Recovery includes validating restored service before declaring normal operation
  • Model drift can threaten continuity without an obvious infrastructure outage
  • Recovery instructions must remain accessible when primary systems are unavailable
  • Personnel safety takes priority over rapid system recovery
  • Crisis communications use approved statements and designated spokespersons

Unlock with Premium — includes all practice exams and the complete study guide.

Also tested in

References

  1. https://www.isc2.org/certifications/cc/cc-certification-exam-outline
  2. https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-34r1.pdf
  3. https://csrc.nist.gov/glossary/term/resilience
  4. https://csrc.nist.gov/glossary/term/failover
  5. https://csrc.nist.gov/glossary/term/business_continuity_plan
  6. https://csrc.nist.gov/glossary/term/business_impact_analysis
  7. https://www.cisa.gov/stopransomware/ransomware-guide
  8. https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf