456 Appendix ■ Answers
10 9. The disaster recovery test types, listed in order of their potential impact on the business
from the least impactful to the most impactful, are as follows:
A. Checklist review
B. Parallel test
C. Tabletop exercise
D. Full interruption test
Checklist reviews are the least impactful type of exercise because they do not even
require a meeting. Each team member reviews the checklist on his or her own. Tabletop
exercises are slightly more impactful because they require bringing together the DR
team in the same room. Parallel tests require the activation of alternate processing sites
and require significant resources. Full interruption tests are the most impactful type of
exercise because they involve shifting operations to the alternate site and could disrupt
production activity.- C. Interference is electrical noise or other disruptions that corrupt the contents of packets.
Latency is a delay in the delivery of packets from their source to their destination. Jitter is
a variation in the latency for different packets. Packet loss is the disappearance of packets
in transit that requires retransmission. - A. Fagan inspections follow a rigorous, highly structured process to perform code review,
using a planning, overview, preparation, inspection, rework, and follow-up cycle. Fuzzing
feeds unexpected input to programs, while over-the-shoulder code review is simply a
review by having another developer meet with them to review code using a walk-through.
Pair programming uses a pair of developers, one of whom writes code while both talk
through the coding and development process.
112. B. While removing the <SCRIPT> tag from user input, it is not sufficient, as a user may
easily evade this filter by encoding the tag with an XSS filter evasion technique. Frank
was correct to perform validation on the server rather than at the client, but he should use
validation that limits user input to allowed values, rather than filtering out one potentially
malicious tag.- C. Fortran is a functional programming language. Java, C++, and C# are all object-
oriented languages, meaning that they use the object model and approach programming as
describing the interactions between objects. - C. HIPAA requires that anyone working with personal health information on behalf of a
HIPAA-covered entity be subject to the terms of a business associates agreement (BAA). - A. During a full interruption test, the team takes down the primary site and confirms that
the disaster recovery site is capable of handling regular operations. The full interruption
test is the most thorough test but also the most disruptive. During a parallel test, the
team actually activates the disaster recovery site for testing but the primary site remains
operational. The checklist review is the least disruptive type of disaster recovery test.
During a checklist review, team members each review the contents of their disaster
recovery checklists on their own and suggest any necessary changes. During a tabletop
exercise, team members come together and walk through a scenario without making any
changes to information systems.