I85PREP
⌘ K
BCB-PMD study materials
BCB-PMD study resources

BCB-PMD practice questions

One question at a time. Build your BCB-PMD understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Business Continuity Management Program Foundation

In business continuity management, what does the business impact analysis (BIA) primarily establish?

  1. The annual insurance premium payable for each company facility
  2. The disciplinary process for employees who breach security policy
  3. The recovery priorities and resource requirements for critical business functions Correct answer.
  4. The marketing budget allocated to each product line

Explanation

The BIA identifies time-critical business functions, quantifies the operational and financial consequences of their disruption over time, and establishes recovery priorities and dependencies. Those outputs then drive strategy selection and planning. It is an analytical input to the program, not a financial or human-resources exercise.

Question 2Business Continuity Management Program Foundation

Which statement best describes the role of a business continuity policy?

  1. It records the detailed recovery steps for each individual application server
  2. It sets top management's direction, scope, and mandatory requirements for the program Correct answer.
  3. It replaces the need for periodic testing of continuity arrangements
  4. It lists the names of every supplier the organization uses

Explanation

A policy is a short, management-approved statement of intent that defines scope, objectives, governance roles, and mandatory requirements. Detailed procedures and recovery steps belong in plans, and supplier lists belong in dependency records. Policy authorizes the program; it does not substitute for exercising it.

Question 3Business Continuity Management Program Foundation

What is the main purpose of defining a maximum tolerable period of disruption (MTPD) for a business function?

  1. To set the outer limit beyond which the disruption's impact becomes unacceptable Correct answer.
  2. To specify the exact clock time at which the crisis team must convene
  3. To determine the number of staff eligible for overtime pay
  4. To calculate the depreciation schedule of recovery equipment

Explanation

The MTPD expresses the longest time a function can be unavailable before the consequences become unacceptable to the organization and its stakeholders. Recovery time objectives are then set within that limit, leaving a margin for plan activation. It is an impact threshold, not a scheduling or payroll figure.

Question 4Business Continuity Management Program Foundation

An organization completes its BIA and discovers that a payment system must resume within four hours. What is the most appropriate next step in the program?

  1. Defer all action until the next annual budget cycle
  2. Record the objective and rely on staff improvisation during an incident
  3. Select and document recovery strategies capable of meeting the four-hour objective Correct answer.
  4. Remove the system from scope because four hours is unrealistic

Explanation

Once a recovery objective is agreed, the program must identify strategies, resources, and dependencies that can realistically achieve it, then document them in plans. Objectives without supporting capability are aspirational only. Improvisation or deferral leaves a known gap unaddressed.

Question 5Business Continuity Management Program Foundation

Which item is typically a responsibility of the business continuity coordinator rather than of the crisis management team?

  1. Negotiating with regulators on behalf of the board
  2. Declaring a company-wide state of emergency
  3. Authorizing emergency expenditure above the delegated threshold
  4. Maintaining and updating the continuity plans assigned to them Correct answer.

Explanation

Coordinators or plan owners keep their functional plans current, run exercises, and maintain contact and dependency data. Declarations, high-value spending approvals, and external regulatory negotiation sit with senior crisis leadership or executive authority. The distinction separates routine program maintenance from decision authority.

Question 6Business Continuity Management Program Foundation

A program team is choosing between a hot site and a warm site for a critical service. Which consideration most directly favors the hot site?

  1. The organization wants the lowest possible annual cost
  2. The service must resume within minutes and requires fully replicated data Correct answer.
  3. The service can tolerate several days of downtime
  4. The organization prefers to rebuild infrastructure after each disruption

Explanation

A hot site maintains continuously available infrastructure and near-real-time data replication, supporting very short recovery objectives. Warm sites offer partial readiness and slower resumption at lower cost. Strategy selection must follow the recovery objective rather than cost alone.

Question 7Business Continuity Management Program Foundation

Why should business continuity plans be tested at planned intervals?

  1. To transfer legal liability for outages to the exercise participants
  2. To replace the need for plan maintenance between tests
  3. To verify that strategies, contacts, and dependencies still work as assumed Correct answer.
  4. To satisfy a one-time documentation requirement at program launch

Explanation

Exercises validate assumptions about people, technology, suppliers, and timing, and they reveal gaps that documentation alone cannot expose. Findings feed corrective actions and plan updates. Testing is therefore a recurring control, not a one-off launch task.

Question 8Business Continuity Management Program Foundation

What is the primary function of an alternate or recovery site within a continuity strategy?

  1. To store archived financial records for statutory retention
  2. To serve as the permanent headquarters after a merger
  3. To host the organization's routine staff training events
  4. To provide a pre-arranged location where critical operations can be resumed Correct answer.

Explanation

An alternate site is a pre-identified facility with the space, systems, and connectivity needed to resume prioritized operations after displacement. Pre-arrangement reduces the time lost to improvisation. It is a continuity resource, not an administrative or archival facility.

Question 9Business Continuity Management Program Foundation

Which statement correctly distinguishes a business continuity plan from a disaster recovery plan?

  1. The continuity plan covers only suppliers, while disaster recovery covers only employees
  2. The continuity plan is written after an incident, while disaster recovery is written before
  3. The continuity plan focuses on business processes and people, while disaster recovery focuses on restoring technology and data Correct answer.
  4. The continuity plan is only used by IT staff, while disaster recovery is used by business managers

Explanation

Business continuity planning addresses the whole organization's ability to keep delivering products and services, including people, premises, and suppliers. Disaster recovery is the technology-focused subset concerned with restoring systems and data. The two are complementary layers of the same program.

Question 10Business Continuity Management Program Foundation

A risk assessment within the continuity program is primarily used to do what?

  1. Replace the business impact analysis with a financial audit
  2. Guarantee that no disruptive event will ever occur
  3. Determine individual employee performance ratings
  4. Identify and evaluate threats, vulnerabilities, and likelihood to inform continuity decisions Correct answer.

Explanation

Risk assessment identifies credible threats and vulnerabilities, estimates likelihood and consequence, and helps prioritize where continuity controls are needed. It complements the BIA, which focuses on impact over time. Neither process can eliminate all disruption.

Question 11Business Continuity Management Program Foundation

In a continuity program, what does a dependency map help planners understand?

  1. The tax treatment of recovery-related expenditure
  2. The sequence in which staff take annual leave
  3. The historical share price of the organization
  4. The linkages between critical functions and the resources, suppliers, and systems they rely on Correct answer.

Explanation

Dependency mapping traces the internal and external resources a prioritized function needs, such as systems, utilities, third parties, and key people. It exposes single points of failure that could undermine a recovery objective. The output informs strategy and plan content.

Question 12Business Continuity Management Program Foundation

Which element is essential in the activation section of an incident response and continuity plan?

  1. A list of past marketing campaigns
  2. Clear criteria and authority for declaring an incident and invoking the plan Correct answer.
  3. A summary of competitor product launches
  4. The full text of the organization's code of conduct

Explanation

Plans must state who may activate them and under what conditions, so response is not delayed by ambiguity over authority. Activation criteria translate observed events into a decision to mobilize resources. Other corporate documents do not serve this operational purpose.

Question 13Business Continuity Management Program Foundation

A crisis communication plan should include which of the following as a core component?

  1. A pre-approved statement template and designated spokesperson with clear approval routing Correct answer.
  2. A policy of withholding all information until an investigation concludes
  3. A requirement that all employees speak to the press independently
  4. A guarantee that no media will contact the organization

Explanation

Effective crisis communication relies on pre-approved templates, identified spokespeople, and defined approval routes so messages are timely and consistent. Stakeholders expect prompt, accurate information during disruption. Silence or uncoordinated messaging erodes trust.

Question 14Business Continuity Management Program Foundation

Which metric best demonstrates that a continuity program is maturing over time?

  1. The age of the organization's office furniture
  2. The percentage of critical functions whose recovery capability has been validated through exercises Correct answer.
  3. The total number of employees who have never attended awareness training
  4. The number of pages in the continuity plan document

Explanation

Maturity is shown by validated capability, meaning that recovery objectives for critical functions have been demonstrated through exercises and that gaps are tracked to closure. Document volume is a poor proxy for effectiveness. Metrics should reflect tested performance, not activity counts.

Question 15Business Continuity Management Program Foundation

What is the purpose of a corrective action register in a continuity program?

  1. To document the annual marketing plan
  2. To replace the risk assessment process
  3. To list the personal contact details of all customers
  4. To record exercise findings and track remediation to closure with owners and dates Correct answer.

Explanation

A corrective action register captures issues found in exercises, audits, and incidents, assigns an owner and due date, and tracks resolution. It converts findings into demonstrable improvement and provides evidence for management review. It supports, but does not replace, risk assessment.

Question 16Business Continuity Management Program Foundation

During a disruption, why is a pre-agreed order of priority for critical functions valuable?

  1. It removes the need for any communication with stakeholders
  2. It allows the organization to avoid documenting recovery objectives
  3. It ensures the largest department is recovered first regardless of impact
  4. It allocates scarce recovery resources to the functions whose loss causes the greatest harm Correct answer.

Explanation

When resources such as staff, power, or systems are constrained, recovery must follow impact-based priorities rather than organizational size or seniority. Pre-agreed priorities reduce debate during a crisis. They also guide sequencing of interdependent functions.

Question 17Business Continuity Management Program Foundation

What is the primary objective of an awareness and training component in a continuity program?

  1. To reduce the number of continuity plans the organization must maintain
  2. To ensure staff understand their roles and can respond appropriately when a disruption occurs Correct answer.
  3. To certify every employee as a qualified internal auditor
  4. To transfer responsibility for continuity to external consultants

Explanation

Awareness ensures people recognize activation signals and know their assigned duties, while training builds the specific skills needed for their roles. Competent response depends on both. Training does not substitute for plans or accountability.

Question 18Business Continuity Management Program Foundation

An organization relies on a single supplier for a component essential to its main product. What continuity action is most appropriate?

  1. Assume the supplier will never fail because of a long-standing contract
  2. Remove the product from the catalog immediately without analysis
  3. Increase marketing spend to offset the risk
  4. Identify an alternate source or buffer stock and include the dependency in continuity plans Correct answer.

Explanation

Single-source dependencies are a classic point of failure, so programs identify alternate suppliers, qualify them in advance, or hold buffer inventory. The dependency is then documented with contingency arrangements in the plan. Contracts alone do not remove the risk.

Question 19Business Continuity Management Program Foundation

Which statement best captures the concept of a recovery time objective (RTO)?

  1. The maximum acceptable duration of disruption before a function must be restored Correct answer.
  2. The total cost of rebuilding a damaged facility
  3. The length of time a backup copy must be retained
  4. The interval between scheduled backup runs

Explanation

The RTO is the target time within which a function or system must be restored after disruption, and it is set within the MTPD. It drives strategy selection and resource sizing. Retention periods and backup schedules are separate technical parameters.

Question 20Business Continuity Management Program Foundation

A program team wants to test a plan without disrupting live operations. Which exercise type is most suitable for a first validation of roles and decision-making?

  1. A full-scale relocation of all staff to the alternate site
  2. A live failover of production systems during peak trading
  3. An unannounced shutdown of the primary data center
  4. A tabletop exercise walking through a scenario with key participants Correct answer.

Explanation

Tabletop exercises let participants rehearse decisions, communication, and role clarity in a discussion-based setting with minimal operational risk. They are a sensible first step before more resource-intensive live tests. Higher-impact tests follow once roles and plans are validated.

Question 21Business Continuity Management Program Foundation

Why does a continuity program require management review at defined intervals?

  1. To confirm that the program remains aligned with business objectives, risk, and regulatory obligations Correct answer.
  2. To reduce the number of staff required in the organization
  3. To assign blame for past incidents to specific employees
  4. To eliminate the need for internal audit activity

Explanation

Management review verifies that scope, priorities, strategies, and resources still match the organization's objectives, risk profile, and legal duties. It provides direction and resources for corrective actions. It complements rather than replaces independent assurance.

Question 22Business Continuity Management Program Foundation

Which factor most strongly indicates that a business function should be classified as time-critical?

  1. It uses the newest software in the organization
  2. Its disruption would quickly cause severe harm to safety, finances, or legal compliance Correct answer.
  3. It has the largest number of staff assigned to it
  4. It is managed by the longest-serving department head

Explanation

Time-criticality is determined by the speed and severity of harm once a function stops, measured against the MTPD. Safety, financial, regulatory, and reputational consequences are the deciding factors. Headcount, tenure, and technology novelty are not impact measures.

Question 23Business Continuity Management Program Foundation

What is the role of mutual aid or reciprocal arrangements in continuity strategy?

  1. They remove the need to document recovery objectives for either party
  2. They transfer all legal liability for an outage to the partner organization
  3. They allow two organizations to share recovery resources under a formal, tested agreement Correct answer.
  4. They guarantee identical technology platforms across both organizations

Explanation

Reciprocal arrangements let organizations share facilities, equipment, or skills under a documented agreement, which can be cost-effective for smaller entities. The agreement must define scope, priorities, and constraints, and it must be exercised to confirm it works. It does not transfer accountability.

Question 24Business Continuity Management Program Foundation

A newly appointed continuity manager finds plans exist but have never been exercised and no owners are named. Which action should come first?

  1. Commission a complete rewrite of every plan before any other step
  2. Wait for the next incident to reveal which plans are useful
  3. Delete the plans and start the program from scratch
  4. Establish ownership and a scheduled exercise program to validate existing plans Correct answer.

Explanation

Assigning plan owners and scheduling validation turns static documents into a managed capability and reveals where content is deficient. Exercising existing plans is faster and more informative than wholesale rewriting. Discarding them or waiting for an incident wastes existing work.

Question 25Risk Assessment and Business Impact Analysis

Which document establishes the acceptable level of disruption an organization is willing to tolerate for a given business process?

  1. The recovery time objective
  2. The maximum tolerable period of disruption Correct answer.
  3. The service level agreement
  4. The recovery point objective

Explanation

The maximum tolerable period of disruption defines how long a process can be unavailable before unacceptable harm occurs, so it sets the tolerance threshold used to derive recovery targets. Recovery time and recovery point objectives are derived targets rather than the tolerance itself, and a service level agreement is a contractual commitment.

Question 26Risk Assessment and Business Impact Analysis

A business impact analysis is primarily conducted to determine which of the following?

  1. The technical configuration baseline of each server
  2. The criticality of processes and the consequences of their disruption Correct answer.
  3. The annual insurance premium for cyber risk
  4. The vendor pricing for alternate recovery sites

Explanation

A business impact analysis identifies time-critical business processes and quantifies the operational and financial consequences of their disruption over time. This output then drives recovery prioritization and strategy selection. Technical baselines, vendor pricing, and insurance premiums are separate inputs or downstream decisions.

Question 27Risk Assessment and Business Impact Analysis

Which risk assessment approach relies primarily on structured judgment from experienced personnel rather than numerical frequency data?

  1. Probabilistic modeling
  2. Qualitative analysis Correct answer.
  3. Quantitative analysis
  4. Actuarial analysis

Explanation

Qualitative risk assessment uses descriptive scales and expert judgment to rate likelihood and impact when reliable numerical data is unavailable. Quantitative and actuarial approaches depend on measurable frequency and loss data, and probabilistic modeling requires statistical inputs.

Question 28Risk Assessment and Business Impact Analysis

What is the main purpose of defining recovery time objectives during business impact analysis?

  1. To rank processes by the urgency of their restoration Correct answer.
  2. To specify the minimum backup frequency for databases
  3. To calculate the total cost of ownership of assets
  4. To record the legal retention period for records

Explanation

Recovery time objectives translate impact tolerance into a restoration deadline for each process, which allows planners to rank restoration urgency and select proportionate strategies. Backup frequency relates to the recovery point objective, retention is a records issue, and total cost of ownership is an asset management measure.

Question 29Risk Assessment and Business Impact Analysis

Which statement best describes residual risk?

  1. The risk transferred to a third party by contract
  2. The risk identified before any controls exist
  3. The risk that remains after controls have been applied Correct answer.
  4. The risk that a control will fail during an audit

Explanation

Residual risk is the exposure that persists after existing controls and mitigation measures are taken into account. Inherent risk is the exposure before controls, and risk transfer shifts financial consequence without eliminating the underlying exposure.

Question 30Risk Assessment and Business Impact Analysis

Which of the following is a lagging indicator of risk exposure in an organization?

  1. The number of unpatched vulnerabilities currently open
  2. The percentage of staff who completed awareness training
  3. The frequency of security incidents recorded last quarter Correct answer.
  4. The count of privileged accounts awaiting review

Explanation

Lagging indicators measure outcomes that have already occurred, such as realized incident frequency in a past period. Open vulnerabilities, training completion, and pending access reviews are leading indicators because they reflect current conditions that may predict future incidents.

Question 31Risk Assessment and Business Impact Analysis

In a risk register, what does the risk owner primarily do?

  1. Perform the independent audit of controls
  2. Approve the enterprise risk appetite statement
  3. Account for the management of a specific risk Correct answer.
  4. Fund the insurance program for the entity

Explanation

A risk owner is the individual accountable for monitoring and managing a specific risk and its treatment within delegated authority. Enterprise appetite is approved at executive or board level, audit independence belongs to assurance functions, and insurance funding is a treasury or risk-financing activity.

Question 32Risk Assessment and Business Impact Analysis

Which business process characteristic most strongly indicates that it should be classified as time-critical?

  1. It has the highest number of automated interfaces
  2. It causes severe harm within hours if interrupted Correct answer.
  3. It is performed by the largest headcount team
  4. It consumes the largest share of the IT budget

Explanation

Time-criticality is determined by how quickly disruption produces severe consequences, so a process with harm measured in hours has the tightest tolerance. Team size, interface count, and budget share describe scale or complexity rather than the speed of impact.

Question 33Risk Assessment and Business Impact Analysis

A process has a maximum tolerable period of disruption of 24 hours and a recovery time objective of 8 hours. What does the gap between these two values represent?

  1. The time needed to declare a disaster
  2. The maximum acceptable data loss window
  3. The minimum backup interval required
  4. The contingency margin between the target and the tolerance Correct answer.

Explanation

The recovery time objective must be tighter than the maximum tolerable period of disruption, and the difference is the buffer available for decision-making, escalation, and unforeseen delays before harm becomes unacceptable. Backup intervals relate to the recovery point objective, and declaration time is only one component of the recovery effort.

Question 34Risk Assessment and Business Impact Analysis

A company can tolerate losing at most 20 minutes of transaction data, and its current replication lags by 45 minutes. What is the most accurate conclusion?

  1. The backup retention policy is inadequate
  2. The recovery point objective is not being met Correct answer.
  3. The maximum tolerable period of disruption is too short
  4. The recovery time objective is being exceeded

Explanation

Tolerable data loss is expressed as the recovery point objective, so a 45-minute replication lag against a 20-minute objective means the objective is unmet. Recovery time objective concerns downtime duration, the maximum tolerable period of disruption concerns overall outage tolerance, and retention governs how long copies are kept.

Question 35Risk Assessment and Business Impact Analysis

During a business impact analysis interview, a department head insists every process is critical. What is the most effective facilitation technique?

  1. Average the ratings with those from another department
  2. Escalate the dispute to the internal audit team
  3. Ask what happens hour by hour if each process stops Correct answer.
  4. Accept the ratings to preserve stakeholder goodwill

Explanation

Time-based impact questioning forces stakeholders to distinguish real harm timelines instead of asserting blanket criticality, producing defensible ratings. Accepting inflated ratings distorts prioritization, audit is not a facilitation resource, and averaging unrelated ratings does not resolve the underlying ambiguity.

Question 36Risk Assessment and Business Impact Analysis

Which pair of factors is typically combined in a risk heat map?

  1. Asset value and depreciation
  2. Control count and audit frequency
  3. Likelihood and impact Correct answer.
  4. Cost and duration

Explanation

A risk heat map plots likelihood against impact so risks can be visualized and ranked by relative severity. Cost and duration describe impact components rather than the axes, and asset value, depreciation, control counts, and audit frequency are not the standard dimensions.

Question 37Risk Assessment and Business Impact Analysis

An organization sets its risk appetite as low for regulatory compliance risk and high for market expansion risk. What does this most directly guide?

  1. The selection of treatment options and acceptance thresholds Correct answer.
  2. The scheduling of the annual penetration test
  3. The format of the incident response report
  4. The choice of database vendor for the finance system

Explanation

Risk appetite expresses how much risk the organization is willing to accept in each category and therefore guides which risks must be treated and which can be accepted. Vendor selection, test scheduling, and report formatting are operational decisions not driven primarily by appetite statements.

Question 38Risk Assessment and Business Impact Analysis

Which technique is most appropriate for identifying dependencies between business processes and supporting IT systems?

  1. A survey of customer satisfaction scores
  2. A review of the asset depreciation schedule
  3. A vulnerability scan of the network perimeter
  4. A business process flow mapping exercise Correct answer.

Explanation

Process flow mapping traces inputs, outputs, and supporting resources, revealing where processes depend on specific systems and suppliers. Vulnerability scanning tests technical weaknesses, depreciation schedules track asset value, and satisfaction surveys measure customer perception.

Question 39Risk Assessment and Business Impact Analysis

What is the primary difference between a risk assessment and a business impact analysis?

  1. Risk assessment addresses likelihood and impact; impact analysis focuses on consequence over time Correct answer.
  2. Risk assessment covers technology; impact analysis covers finance
  3. Risk assessment is performed only by auditors; impact analysis is performed only by IT
  4. Risk assessment is annual; impact analysis is continuous

Explanation

Risk assessment evaluates the likelihood and impact of identified threats and vulnerabilities, while business impact analysis concentrates on the consequences of process disruption across time horizons. Both are cross-functional activities, neither is confined to specific departments or asset classes, and their frequency depends on the program design.

Question 40Risk Assessment and Business Impact Analysis

A business impact analysis reveals that a payroll process can tolerate only a short outage right before payday but a longer one mid-cycle. What does this illustrate?

  1. The process is not critical because it is periodic
  2. The recovery time objective is fixed year-round
  3. Payroll should be excluded from the analysis
  4. Impact varies with timing and must be assessed across scenarios Correct answer.

Explanation

Impact is not constant; it depends on when disruption occurs relative to business cycles, so the analysis should consider multiple timing scenarios. Assuming a single fixed tolerance or excluding cyclical processes would misrepresent the organization's real exposure.

Question 41Risk Assessment and Business Impact Analysis

Which output of the business impact analysis most directly drives the selection of recovery strategies?

  1. The list of open audit findings
  2. The prioritized list of processes with recovery objectives Correct answer.
  3. The inventory of software licenses
  4. The organizational chart of the IT department

Explanation

Recovery strategy selection depends on which processes must be restored first and how quickly, which is exactly what prioritized processes with recovery objectives provide. License inventories, organizational charts, and audit findings inform other planning activities but do not establish recovery priorities.

Question 42Risk Assessment and Business Impact Analysis

A risk is rated high likelihood and low impact, while another is rated low likelihood and high impact. Which consideration is most important when comparing them?

  1. The combination of both, aligned to risk appetite Correct answer.
  2. Only the impact rating matters
  3. The number of controls applied to each
  4. Only the likelihood rating matters

Explanation

Risk severity results from the combination of likelihood and impact, and the decision on whether to treat or accept depends on where that combined exposure sits relative to appetite. Considering only one dimension or counting controls does not capture the actual exposure.

Question 43Risk Assessment and Business Impact Analysis

Which data source is most useful for validating the financial impact figures used in a business impact analysis?

  1. Employee engagement survey results
  2. The IT service desk ticket backlog
  3. The marketing brand style guide
  4. Historical revenue and cost records from finance Correct answer.

Explanation

Finance records provide actual revenue, cost, and loss data that can substantiate or correct impact estimates supplied by process owners. Engagement surveys, ticket backlogs, and style guides do not contain financial loss information relevant to impact quantification.

Question 44Risk Assessment and Business Impact Analysis

An organization defines a risk tolerance threshold and finds a process whose projected loss exceeds it. What is the most appropriate next step?

  1. Identify and evaluate treatment options to reduce exposure Correct answer.
  2. Accept the risk and document the rationale
  3. Increase the tolerance threshold to match the loss
  4. Remove the process from the risk register

Explanation

When projected exposure exceeds the stated tolerance, the organization must evaluate treatment options such as mitigation, transfer, or avoidance to bring exposure within limits. Acceptance is only appropriate when exposure falls within tolerance, and adjusting the threshold to fit the loss inverts the control logic.

Question 45Risk Assessment and Business Impact Analysis

Which metric best demonstrates that a business continuity program is improving over time?

  1. The total number of risks recorded in the register
  2. The number of staff assigned to the continuity team
  3. The percentage of critical processes meeting their recovery objectives in tests Correct answer.
  4. The volume of documentation produced for the plan

Explanation

The proportion of critical processes that actually achieve their recovery objectives during exercises shows whether recovery capability is adequate and improving. Register size, staffing levels, and documentation volume measure activity rather than demonstrated capability.

Question 46Risk Assessment and Business Impact Analysis

A supplier provides a critical service with a contractual recovery commitment of 72 hours, but the relying process has a recovery time objective of 12 hours. What is the most significant finding?

  1. There is a material gap between supplier commitment and business need Correct answer.
  2. The supplier should be audited more frequently
  3. The process should be reclassified as non-critical
  4. The contract price is likely too high

Explanation

Third-party recovery commitments must be consistent with the relying process's recovery objective; a 72-hour commitment against a 12-hour need leaves a material dependency gap requiring mitigation or renegotiation. Price, audit frequency, and reclassification do not address the mismatch between commitment and need.

Question 47Risk Assessment and Business Impact Analysis

In a quantitative risk analysis, an asset valued at 500,000 is exposed to a threat with an annualized rate of occurrence of 0.2 and an exposure factor of 40 percent. What is the annualized loss expectancy?

  1. 200,000
  2. 100,000
  3. 40,000 Correct answer.
  4. 400,000

Explanation

Single loss expectancy equals asset value multiplied by exposure factor, which is 500,000 times 0.4, or 200,000. Annualized loss expectancy multiplies that figure by the annualized rate of occurrence, giving 200,000 times 0.2, or 40,000.

Question 48Risk Assessment and Business Impact Analysis

A business impact analysis shows that two processes share a single database whose recovery objective is looser than either process requires. What is the most appropriate analytical conclusion?

  1. Each process objective should be relaxed to match the database
  2. The shared dependency constrains achievable recovery and needs remediation Correct answer.
  3. The processes should be merged into one
  4. The database should be removed from the asset inventory

Explanation

When a shared dependency cannot meet the tighter objectives of the processes relying on it, the dependency becomes the binding constraint and must be remediated or the objectives renegotiated with informed acceptance. Relaxing objectives without analysis, removing the asset from inventory, or merging processes does not resolve the constraint.

Question 49Risk Assessment and Business Impact Analysis

During validation, process owners consistently underestimate downtime impact compared with historical incident data. Which action best improves the reliability of the analysis?

  1. Average the owner estimates with an arbitrary industry benchmark
  2. Accept the owner estimates because they own the process
  3. Discard the historical data as irrelevant to current operations
  4. Recalibrate estimates using the incident evidence and document assumptions Correct answer.

Explanation

Where subjective estimates conflict with observed evidence, the analysis should be recalibrated against that evidence with assumptions documented, which improves defensibility. Discarding data, blending arbitrary benchmarks, or deferring solely to ownership ignores information that bears directly on accuracy.

Question 50Risk Assessment and Business Impact Analysis

Which statement best describes the purpose of a business impact analysis (BIA) within a business continuity program?

  1. To identify and prioritize the processes and resources that are most critical to the organization's survival Correct answer.
  2. To calculate the annualized loss expectancy for each identified risk scenario
  3. To determine the likelihood and velocity of specific threat events
  4. To select and document the recovery strategies for IT infrastructure

Explanation

A BIA focuses on the business itself: it identifies time-critical processes, quantifies the operational and financial consequences of their disruption, and establishes recovery priorities and objectives. It does not quantify threat likelihood or select technical recovery solutions, which are separate risk assessment and strategy activities.