Exam CISSP topic 1 question 150 discussion

From a CISSP perspective, it is important to document the state of the disaster site before any item is removed, repaired, or replaced. This documentation, in the form of photographs, can be used as evidence in the event of an investigation or lawsuit.

Notify all of the Board of Directors=How? Do you know all the board members? Are they available for your notification? Take photos, use your communication channel to send it up

D correct. You do the CISSP exam from the point of view of a CISO not a forensic analyst. Directors is your first action

Guys yes, photos must be taken. But if the disaster is an outage, what are you gonna do with them? And you are not a technician. You are a manager. You first inform the Board of Directors

C - preserve evidence

Human life and safety are on the first place! If the disaster site is the site where disaster occured and the disaster recovery site is the spare site, we need to dispatch personnel to the safe place first.

What's the use of the picture if the outage is from the service provider's end?

Answer: Send someone to the site. In studying with one of the udemy courses, I came across this outline of typical Diaster Recovery plan activation steps. I had selected 'take pictures, but now rethinking this questions based on new knowledge, the answer is send someone to the site. DR plan activation Steps: 1. Declaration of disaster 2. Activation of the DR team 3. Internal communications (ongoing from here on out) 4. Protection of human safety (e.g., evacuation) 5. Damage assessment 6. Execution of appropriate system-specific DRPs (each system and network should have its own DRP) 7. Recovery of mission-critical business processes/functions 8. Recovery of all other business processes/functions

The answer as technicians is obvious "C", remember, we must think like a Manager, The manager would first notify the board of directors of the disaster. D is the answer

The sequence shall be, B>C>D>A send someone into site and cross check if the damage severity whether fulfill the criteria of disaster. if positive, the record the proof and notify top management, then align with press via PR channels.

C. Take evidence. Also BOD are just after the stocks.

From the point of view of a Certified Information Systems Security Professional (CISSP), the best answer would be C: "Take photos of the damage". This is because photographic documentation is important for maintaining the integrity of the disaster site, as well as for insurance and legal purposes. It is also important to document the damage before any remediation work is done, as this can help to support any insurance claims or legal actions that may be necessary. As a CISSP, it is important to follow best practices for disaster recovery and to ensure that all necessary documentation is collected and preserved.

Secure the site material.

I would say C. What are you going to notify the board of directors with. You need to know what the damage is so that you have something to say to them.

this situation raise a valid point. In some cases, it may be necessary to notify the Board of Directors or senior management immediately after a disaster occurs, especially if the impact is significant and has the potential to affect the organization's operations, reputation, or financials. The decision of whether to notify the Board of Directors at the disaster site before any item is removed, repaired, or replaced would depend on the specific circumstances and the organization's incident response protocols. It's important to have clear communication channels and predefined roles and responsibilities in place to ensure effective decision-making and timely reporting to key stakeholders during a disaster. taking photo and documenting, is also very important prior of any action on ground

It is not clear at all. D makes no sense, the recovery cannot be stop in case a BOD member is not located. C, pictures of a software? of the memory of a computer or files? the only that can have some logic is B.

C is the answer. BOD has already been notified once DR is declared.