I85PREP
⌘ K
CBCI study materials
CBCI study resources

CBCI (Other exams) practice questions

One question at a time. Build your CBCI understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Business Continuity Management (BCM) fundamentals and the BCMS lifecycle

Which statement best describes the relationship between business continuity management and an organization's overall risk management program?

  1. BCM is limited to information technology recovery and excludes operational or supplier risks.
  2. BCM replaces enterprise risk management whenever an organization operates in a single geographic region.
  3. BCM is a one-time project that ends once continuity plans have been documented and approved.
  4. BCM is a specialized discipline that identifies continuity risks and feeds them into the broader enterprise risk process. Correct answer.

Explanation

Business continuity management is a distinct discipline that concentrates on disruptive events and the organization's ability to keep delivering products and services. Its outputs, such as business impact analyses and risk assessments, are inputs to the wider enterprise risk management framework rather than a substitute for it. The two disciplines overlap but neither absorbs the other.

Question 2Business Continuity Management (BCM) fundamentals and the BCMS lifecycle

In the standard BCM lifecycle, which activity typically follows the completion of business impact analysis and risk assessment?

  1. Establishing the scope and governance of the BCMS
  2. Conducting the management review of the BCMS
  3. Performing internal audits of the continuity program
  4. Selecting and implementing business continuity strategies and solutions Correct answer.

Explanation

The lifecycle moves from understanding the organization through analysis, then uses those findings to choose cost-effective strategies that will meet the agreed recovery objectives. Strategy selection is therefore the natural step after impact analysis and risk assessment. Governance and scope setting come earlier, while audit and management review come later in the cycle.

Question 3Business Continuity Management (BCM) fundamentals and the BCMS lifecycle

A newly appointed continuity manager wants to secure executive sponsorship before writing any plans. Which action best demonstrates top management commitment at the start of a BCMS?

  1. Assigning a senior sponsor who approves policy, resources, and continuity objectives Correct answer.
  2. Delegating all continuity decisions to the facilities maintenance team
  3. Waiting for a disruptive incident to reveal which executives support the program
  4. Purchasing recovery software before defining continuity requirements

Explanation

Visible leadership commitment is expressed through an approved continuity policy, named accountability, allocated resources, and defined objectives. These elements give the program authority and direction before detailed planning begins. Commitment that is not backed by decisions and resources does not sustain a BCMS.

Question 4Business Continuity Management (BCM) fundamentals and the BCMS lifecycle

What is the primary purpose of a business impact analysis?

  1. To calculate the insurance premium for each building
  2. To list every employee's home contact details
  3. To document the technical configuration of backup servers
  4. To identify time-sensitive activities and the consequences of their disruption Correct answer.

Explanation

A business impact analysis identifies the activities that support key products and services and quantifies how their disruption affects the organization over time. It establishes recovery priorities and objectives that later drive strategy selection. Technical configuration and contact data are supporting details, not the purpose of the analysis.

Question 5Business Continuity Management (BCM) fundamentals and the BCMS lifecycle

Which term describes the maximum acceptable time that a critical activity can be unavailable before unacceptable harm occurs?

  1. Maximum tolerable period of disruption Correct answer.
  2. Minimum business continuity objective
  3. Recovery time objective
  4. Recovery point objective

Explanation

The maximum tolerable period of disruption is the threshold beyond which the impacts of an outage become unacceptable to the organization. Recovery time objectives are then set within that threshold so that recovery is achieved sooner than the tolerable limit. The two concepts are related but not interchangeable.

Question 6Business Continuity Management (BCM) fundamentals and the BCMS lifecycle

Which document formally states an organization's intent, principles, and responsibilities for business continuity?

  1. The business impact analysis report
  2. The incident log
  3. The business continuity policy Correct answer.
  4. The internal audit plan

Explanation

A business continuity policy is the governing statement that establishes intent, scope, principles, and assigned responsibilities for the BCMS. It provides the mandate against which plans and performance are measured. Reports, audit plans, and logs are operational records rather than governing statements.

Question 7Business Continuity Management (BCM) fundamentals and the BCMS lifecycle

What distinguishes a business continuity plan from an incident response plan?

  1. The continuity plan is written once and never requires testing.
  2. The continuity plan addresses only cyberattacks and data breaches.
  3. The continuity plan focuses on sustaining and recovering priority activities over an extended period. Correct answer.
  4. The continuity plan is used only by external regulators during inspections.

Explanation

Incident response plans concentrate on detecting, containing, and stabilizing an event in its early stages. Business continuity plans then guide the organization in maintaining and restoring priority activities for as long as the disruption lasts. The two plans are complementary and are usually activated in sequence.

Question 8Business Continuity Management (BCM) fundamentals and the BCMS lifecycle

Which statement accurately describes the Plan-Do-Check-Act model as applied to a BCMS?

  1. It requires that continuity plans be discarded after each exercise.
  2. It applies only to manufacturing organizations with physical production lines.
  3. It provides a repeating cycle of establishing, operating, reviewing, and improving continuity capability. Correct answer.
  4. It guarantees that disruptions will never affect the organization.

Explanation

The Plan-Do-Check-Act cycle structures the BCMS as a repeating sequence of establishing requirements, implementing capability, verifying performance, and making improvements. It is generic and applies to any type or size of organization. The model improves resilience but cannot eliminate the occurrence of disruptions.

Question 9Business Continuity Management (BCM) fundamentals and the BCMS lifecycle

An organization's leadership asks how continuity objectives should be set. Which approach aligns with BCM good practice?

  1. Copy the recovery targets published by a competitor in the same industry
  2. Allow each department to choose objectives without reference to impact analysis
  3. Derive objectives from the impacts identified for priority activities and make them measurable Correct answer.
  4. Set every activity to the shortest possible recovery time regardless of cost

Explanation

Continuity objectives should flow from the impact analysis so that they reflect the real consequences of disruption to priority activities. They must also be measurable so progress and exercise results can be evaluated. Cost, feasibility, and interdependencies are then weighed when selecting strategies.

Question 10Business Continuity Management (BCM) fundamentals and the BCMS lifecycle

During a business impact analysis, a team discovers that a payroll process depends on a single external provider. What is the most appropriate next step within the analysis?

  1. Remove payroll from the scope because it is outsourced
  2. Assume the provider's own continuity arrangements guarantee no impact
  3. Defer the finding until the next annual audit cycle
  4. Record the dependency and assess the impact of provider failure on priority activities Correct answer.

Explanation

Outsourcing a process does not transfer accountability for continuity, so supplier dependencies must be captured and their potential impact assessed. This information then informs strategy selection, such as alternate suppliers or retained capability. Ignoring or deferring the finding leaves a critical vulnerability unmanaged.

Question 11Business Continuity Management (BCM) fundamentals and the BCMS lifecycle

Which set of elements most completely describes the scope of a BCMS?

  1. Only the departments that have direct customer contact
  2. Only the data centers owned and operated by the organization
  3. The products, services, locations, processes, and third parties the continuity program covers Correct answer.
  4. Only the risks that appear on the corporate risk register

Explanation

Scope defines the boundaries of the BCMS by naming the products, services, sites, supporting processes, and external dependencies included. Clear scope prevents gaps and duplication and supports consistent objectives. Narrow definitions based on a single asset type or function leave critical activities unprotected.

Question 12Business Continuity Management (BCM) fundamentals and the BCMS lifecycle

A continuity manager is building the team responsible for maintaining the BCMS. Which arrangement best reflects sound practice?

  1. An informal group that meets only after an incident has occurred
  2. Defined roles with named owners, clear authorities, and documented succession for key positions Correct answer.
  3. A single volunteer who handles all continuity tasks alongside a full-time operational job
  4. Responsibility assigned to a committee that has no authority to commit resources

Explanation

Effective continuity governance assigns named owners, documents their authority, and plans for absence or turnover in key roles. This ensures decisions can be made quickly and the program survives staff changes. Informal or under-resourced arrangements tend to collapse precisely when they are needed.

Question 13Business Continuity Management (BCM) fundamentals and the BCMS lifecycle

Why should business continuity awareness and training be provided to staff beyond the core continuity team?

  1. To reduce the number of staff who need to read any plans
  2. So employees recognize disruptions, know their roles, and can act correctly before specialist teams arrive Correct answer.
  3. To satisfy insurance requirements that mandate annual social events
  4. To transfer accountability for continuity from management to frontline staff

Explanation

Awareness ensures that all staff can recognize when something is wrong, follow immediate safety and reporting steps, and understand their part in the response. Trained employees bridge the gap until specialist teams are fully mobilized. Accountability for the program, however, remains with management.

Question 14Business Continuity Management (BCM) fundamentals and the BCMS lifecycle

An organization completes its first round of continuity plans but has never exercised them. What is the most significant risk of this situation?

  1. The plans will automatically expire under most regulatory frameworks
  2. Staff will be unable to locate the plans in the document repository
  3. Plans may contain assumptions and gaps that remain undiscovered until a real disruption Correct answer.
  4. The business impact analysis will need to be repeated from the beginning

Explanation

Exercising tests assumptions about resources, timing, roles, and dependencies that documentation alone cannot validate. Without validation, weaknesses surface during a real event when the cost of failure is highest. Exercises also build familiarity and generate improvement actions.

Question 15Business Continuity Management (BCM) fundamentals and the BCMS lifecycle

Which activity best illustrates the 'Check' phase of the BCMS lifecycle?

  1. Implementing alternate work arrangements for a critical team
  2. Measuring continuity performance and reviewing exercise results against objectives Correct answer.
  3. Assigning a new sponsor to the continuity program
  4. Writing the continuity policy for the first time

Explanation

The Check phase evaluates whether the implemented capability meets the stated objectives through performance measurement, exercises, and reviews. Findings from this phase feed improvement actions in the Act phase. Writing policy, building arrangements, and assigning sponsorship belong to planning and implementation.

Question 16Business Continuity Management (BCM) fundamentals and the BCMS lifecycle

What role does a risk assessment play alongside the business impact analysis?

  1. It determines only the financial audit findings for the year
  2. It estimates the likelihood and consequences of specific threats that could disrupt priority activities Correct answer.
  3. It lists the recovery teams and their contact numbers
  4. It replaces the impact analysis when the organization is small

Explanation

Risk assessment examines the threats and vulnerabilities that could cause disruption and estimates their likelihood and impact. The impact analysis identifies what matters and how quickly it must be restored, while risk assessment explains what could cause the loss. Together they inform strategy selection.

Question 17Business Continuity Management (BCM) fundamentals and the BCMS lifecycle

A retail chain wants to justify investment in a secondary distribution center. Which analysis output most directly supports this decision?

  1. The list of audit findings from the previous financial year
  2. The number of employees who attended last year's awareness session
  3. The marketing plan for the coming holiday season
  4. The recovery objectives and impact timelines for order fulfillment activities Correct answer.

Explanation

Investment in alternate capability is justified by showing how quickly the loss of distribution would harm priority activities and what recovery time is required. Impact timelines and recovery objectives translate directly into facility requirements. Awareness attendance, audit findings, and marketing plans do not establish the cost of disruption to fulfillment.

Question 18Business Continuity Management (BCM) fundamentals and the BCMS lifecycle

How should an organization treat continuity arrangements provided by a critical cloud service provider?

  1. Rely entirely on the provider and remove the service from internal continuity planning
  2. Assume the provider's size guarantees adequate resilience without further checks
  3. Verify the provider's arrangements through contractual commitments and evidence, and align internal plans to them Correct answer.
  4. Replace the provider's arrangements with an internal data center without any analysis

Explanation

The organization retains accountability for the services it delivers, even when components are outsourced. Provider continuity arrangements should be confirmed through contracts, service levels, and evidence, and internal plans should reflect realistic recovery expectations. Assumptions about provider resilience are a common source of planning error.

Question 19Business Continuity Management (BCM) fundamentals and the BCMS lifecycle

What is the main reason a BCMS requires documented information and records?

  1. To provide evidence that the program is operating as intended and to support learning and audit Correct answer.
  2. To satisfy vendors who request copies of internal procedures
  3. To replace the need for exercising and testing
  4. To increase the volume of paperwork reviewed by senior management

Explanation

Documented information preserves decisions, plans, exercise results, and corrective actions so that performance can be evidenced and audited. It also enables learning by showing what was done and what changed as a result. Documentation supports but never substitutes for actual capability and testing.

Question 20Business Continuity Management (BCM) fundamentals and the BCMS lifecycle

An organization sets a recovery time objective of four hours for a critical service but its only tested capability is twenty-four hours. What is the most appropriate interpretation?

  1. The objective should be ignored because it has not yet been met
  2. No action is needed because objectives are aspirational rather than binding
  3. There is a capability gap that requires investment, revised objectives, or both Correct answer.
  4. The tested result proves the objective was set too aggressively and must be withdrawn

Explanation

A mismatch between the required recovery time and demonstrated capability is a gap that must be closed or formally accepted. Options include additional investment, revised strategies, or a documented decision to change the objective. Leaving the discrepancy unaddressed creates a false sense of preparedness.

Question 21Business Continuity Management (BCM) fundamentals and the BCMS lifecycle

Which statement best captures the principle of continual improvement within a BCMS?

  1. Improvement is achieved solely by increasing the length of continuity documents
  2. Performance is regularly evaluated and corrective actions are implemented to strengthen capability over time Correct answer.
  3. Improvement is limited to replacing staff who leave the continuity team
  4. Improvement occurs automatically once a plan has been approved

Explanation

Continual improvement uses performance evaluation, exercise findings, incidents, and audits to identify and implement corrective actions. The aim is a measurable increase in capability and resilience rather than more documentation. Improvement must be actively managed because it does not occur on its own.

Question 22Business Continuity Management (BCM) fundamentals and the BCMS lifecycle

A multinational firm operates in several jurisdictions with differing continuity regulations. How should it structure its BCMS?

  1. Apply the least stringent regulation across all locations to simplify administration
  2. Adopt a common framework with local adaptations that satisfy each jurisdiction's specific requirements Correct answer.
  3. Defer all continuity decisions to whichever regulator issues the largest fine
  4. Maintain entirely separate programs with no shared standards or reporting

Explanation

A common framework provides consistency, shared learning, and efficient governance, while local adaptation ensures each jurisdiction's legal and regulatory obligations are met. The most demanding applicable requirement should inform the baseline. Fragmented or lowest-common-denominator approaches create gaps and inconsistent capability.

Question 23Business Continuity Management (BCM) fundamentals and the BCMS lifecycle

Senior leaders question whether continuity exercises provide value beyond compliance. Which argument best justifies a risk-based exercise program?

  1. Exercises guarantee that recovery objectives will be achieved in a real event
  2. Exercises eliminate the need for a business impact analysis in future years
  3. Exercises reveal interdependency failures and decision-making weaknesses that documentation cannot expose Correct answer.
  4. Exercises transfer legal liability for disruptions to exercise participants

Explanation

Realistic exercises expose coordination problems, untested assumptions, and decision bottlenecks that static plans conceal. These findings drive targeted improvements and build confidence among responders. Exercises inform but never replace impact analysis, and no exercise can guarantee outcomes in an actual disruption.

Question 24Business Continuity Management (BCM) fundamentals and the BCMS lifecycle

An organization's continuity program has strong plans but no linkage to its enterprise risk register. What is the most likely consequence?

  1. The organization will fail its next financial statement audit
  2. Employees will lose access to the continuity policy
  3. The continuity plans will automatically become invalid within one year
  4. Continuity risks may be omitted from enterprise prioritization and funding decisions Correct answer.

Explanation

Linking continuity findings to the enterprise risk register ensures that significant continuity exposures are visible to decision makers and compete for resources. Without that linkage, continuity risks can be overlooked during prioritization and budgeting. The other outcomes are neither automatic nor related to the missing linkage.

Question 25Business Continuity Management (BCM) fundamentals and the BCMS lifecycle

A continuity manager must decide whether to invest in a hot site or accept a longer recovery period for a moderately critical service. Which consideration is most decisive?

  1. The preference of the vendor that supplies the organization's backup software
  2. The point at which the cost of disruption exceeds the cost of the additional recovery capability Correct answer.
  3. The number of pages in the existing continuity plan
  4. The seniority of the manager who originally wrote the plan

Explanation

Strategy selection balances the financial and non-financial impact of disruption against the cost of achieving faster recovery. Where the cost of disruption is lower than the cost of added capability, accepting a longer recovery period may be justified and documented. Vendor preferences, document length, and authorship are not decision criteria.

Question 26Business Continuity Management (BCM) fundamentals and the BCMS lifecycle

Which term describes the state of an organization's ability to continue delivering products or services at acceptable predefined levels after a disruptive incident?

  1. Supply chain resilience
  2. Operational excellence
  3. Business continuity Correct answer.
  4. Crisis communications

Explanation

Business continuity is defined as the capability of an organization to continue the delivery of products or services at acceptable predefined levels following a disruptive incident. It is the outcome the management system exists to protect, distinct from supporting disciplines such as communications or procurement.

Question 27Business Continuity Management (BCM) fundamentals and the BCMS lifecycle

Which sequence correctly orders the four phases of the Plan-Do-Check-Act cycle as used to manage a BCMS?

  1. Plan, Do, Check, Act Correct answer.
  2. Check, Plan, Act, Do
  3. Plan, Check, Do, Act
  4. Do, Plan, Act, Check

Explanation

The cycle begins with Plan, where policy, objectives, and processes are established. Do implements and operates them, Check monitors and reviews performance against objectives, and Act takes corrective action and drives improvement before the cycle repeats.

Question 28Business Continuity Management (BCM) fundamentals and the BCMS lifecycle

What is the primary purpose of establishing a business continuity policy?

  1. To document the results of the most recent impact analysis
  2. To list the contact details of every employee and supplier
  3. To record the detailed recovery steps for each critical system
  4. To set direction, commitment, and accountability for continuity Correct answer.

Explanation

A policy is a top-level statement of intent that establishes direction, commitment, and accountability for business continuity and authorizes the management system. Detailed procedures, analysis results, and contact data belong in lower-level plans and records that the policy governs.

Question 29Business Continuity Management (BCM) fundamentals and the BCMS lifecycle

Which statement best describes the relationship between a business impact analysis and a risk assessment in the BCM lifecycle?

  1. The risk assessment replaces the impact analysis once continuity strategies are implemented
  2. The impact analysis and risk assessment are alternative techniques and only one is needed
  3. The impact analysis identifies threats and likelihoods while the risk assessment sets recovery priorities
  4. The impact analysis determines consequences and timeframes while the risk assessment evaluates likelihood and controls Correct answer.

Explanation

The two analyses answer different questions and are complementary. The impact analysis establishes the consequences of disruption over time and derives recovery priorities, while the risk assessment examines what could cause disruption, how likely it is, and how existing controls affect it.

Question 30Business Continuity Management (BCM) fundamentals and the BCMS lifecycle

An organization is defining the scope of its BCMS. Which approach best reflects good practice?

  1. Scope the BCMS to whatever activities were disrupted in the last incident
  2. Scope the BCMS only to the IT department because it hosts the critical systems
  3. Scope the BCMS to the largest revenue-generating business unit only
  4. Scope the BCMS to the whole organization and then document justified exclusions Correct answer.

Explanation

Good practice starts from the full organization and then narrows scope through documented, justified exclusions so that dependencies and interfaces are not silently lost. Exclusions must be recorded with rationale and accepted by management, since continuity failures often originate outside the assumed boundary.

Question 31Business Continuity Management (BCM) fundamentals and the BCMS lifecycle

A continuity manager is selecting strategies to address a recovery gap. Which consideration should drive the choice among viable options?

  1. The option preferred by the largest internal department
  2. The option that uses the newest available technology
  3. The option that requires the least documentation to implement
  4. The option that best balances recovery capability against cost and risk Correct answer.

Explanation

Strategy selection compares options against the recovery objectives and the risk appetite, weighing the cost of the arrangement against the residual risk it leaves. Technology novelty, internal politics, or documentation effort are not valid primary criteria for choosing continuity strategies.

Question 32Business Continuity Management (BCM) fundamentals and the BCMS lifecycle

What is the main purpose of conducting exercises and tests within a BCMS?

  1. To satisfy auditors by producing attendance records
  2. To demonstrate that no further planning investment is required
  3. To validate that arrangements work and to identify improvement actions Correct answer.
  4. To rank individual employees on their response speed

Explanation

Exercises validate that plans, strategies, and capabilities perform as intended under realistic conditions and reveal gaps that feed corrective action and continual improvement. The learning and validation outcome is the objective, with records being a by-product rather than the purpose.

Question 33Business Continuity Management (BCM) fundamentals and the BCMS lifecycle

An organization wants its continuity arrangements to remain current as the business changes. Which practice best supports this?

  1. Freezing the business continuity plan for a fixed multi-year period
  2. Relying on the continuity team to notice changes informally
  3. Reviewing plans only after a real disruption occurs
  4. Assigning ownership and scheduling periodic reviews triggered by change Correct answer.

Explanation

Sustaining currency requires clear ownership plus scheduled reviews and change-triggered updates, such as reorganizations, new systems, or supplier changes. This combines routine maintenance with event-driven revision so plans track the actual operating environment.

Question 34Business Continuity Management (BCM) fundamentals and the BCMS lifecycle

Which set of roles is essential for effective governance of a BCMS?

  1. An external consultant who holds all continuity knowledge
  2. A committee of frontline staff without management authority
  3. Sponsorship by top management plus defined coordination and business ownership roles Correct answer.
  4. Only the continuity manager, who performs all activities personally

Explanation

Effective governance pairs visible top-management sponsorship, which provides authority and resources, with defined coordination and business-owner roles that carry out and own continuity activities. Distributing responsibility this way keeps the program resourced, accountable, and embedded in the business.

Question 35Business Continuity Management (BCM) fundamentals and the BCMS lifecycle

An organization has identified a critical activity and its maximum tolerable period of disruption. What should happen next in the BCM lifecycle?

  1. Publish the business impact analysis and close the project
  2. Defer strategy selection until the next annual budget cycle
  3. Reduce the criticality rating so no strategy is needed
  4. Select and implement strategies that keep recovery within the tolerable period Correct answer.

Explanation

Once impact analysis establishes recovery priorities and the maximum tolerable period of disruption, the lifecycle moves to selecting and implementing strategies capable of meeting those timeframes. Publishing the analysis without acting on it leaves an unmitigated gap between requirement and capability.

Question 36Business Continuity Management (BCM) fundamentals and the BCMS lifecycle

Which statement best describes the role of interested parties in establishing a BCMS?

  1. Their expectations are fixed and never need re-evaluation
  2. Their requirements should be identified and addressed within the management system Correct answer.
  3. Their needs are irrelevant because continuity is an internal technical matter
  4. Only regulators count as interested parties for continuity purposes

Explanation

A management system must determine the interested parties relevant to continuity and understand their requirements, which may include customers, regulators, insurers, and staff. These requirements shape obligations and objectives and must be reviewed as circumstances change.

Question 37Business Continuity Management (BCM) fundamentals and the BCMS lifecycle

A continuity team completes a full exercise and finds that an alternate site lacks a required network configuration. What is the most appropriate next step?

  1. Record the finding and schedule corrective action with an owner and due date Correct answer.
  2. Wait for the next scheduled exercise to see if the issue recurs
  3. Remove the finding from the report because the exercise otherwise succeeded
  4. Change the recovery objective so the gap no longer matters

Explanation

Findings from exercises should be captured, assigned to an accountable owner with a target date, and tracked to closure as part of corrective action. This closes the loop between validation and improvement rather than leaving a known capability gap unresolved.

Question 38Business Continuity Management (BCM) fundamentals and the BCMS lifecycle

An organization's continuity program is mature, but leadership wants evidence that the BCMS delivers value beyond compliance. Which measure best demonstrates this?

  1. The number of pages contained in the continuity documentation set
  2. Trends in recovery capability against objectives and reduced exposure from closed findings Correct answer.
  3. The frequency with which the continuity team meets internally
  4. The count of staff who have read the continuity policy

Explanation

Value is demonstrated by trends showing improved recovery capability against defined objectives and by measurable reduction in exposure as findings are closed. These indicators connect continuity activity to reduced operational risk, whereas volume and activity counts show effort rather than outcome.

Question 39Business Continuity Management (BCM) fundamentals and the BCMS lifecycle

A continuity manager must decide between two strategies for a moderately critical service: a costly fully redundant site or acceptance of a longer recovery period within the tolerable limit. Which reasoning is most sound?

  1. Choose the lower-cost option because the tolerable limit is met and residual risk is acceptable Correct answer.
  2. Choose full redundancy because higher cost always signals greater resilience
  3. Choose full redundancy to avoid documenting any residual risk
  4. Defer the decision indefinitely because both options carry some risk

Explanation

Strategy selection should be risk-based: if a lower-cost option still recovers the service within its maximum tolerable period of disruption and leaves residual risk within appetite, it is the proportionate choice. Spending beyond the requirement adds cost without reducing unacceptable risk.

Question 40Business Continuity Management (BCM) fundamentals and the BCMS lifecycle

An organization discovers that a critical service depends on a supplier whose continuity capability is unknown. What is the most appropriate treatment within the BCMS?

  1. Assume the supplier's continuity arrangements are adequate until a failure occurs
  2. Assess the supplier's continuity capability and define contingency or contractual safeguards Correct answer.
  3. Replace the supplier immediately regardless of the service's criticality
  4. Remove the service from scope so the dependency no longer appears

Explanation

Supplier dependencies should be assessed for continuity capability and then managed through contractual requirements, verification, and contingency arrangements proportionate to the service's criticality. This treats the dependency as part of the organization's own continuity exposure rather than an external matter.

Question 41Business impact analysis and risk assessment

What is the primary purpose of a business impact analysis (BIA)?

  1. To document employee performance review cycles
  2. To catalog every software license held by the organization
  3. To schedule routine equipment maintenance activities
  4. To identify time-sensitive processes and quantify the consequences of their disruption Correct answer.

Explanation

A BIA identifies the organization's critical business processes and determines the operational and financial consequences that would result if each were disrupted. It establishes recovery priorities and time objectives that drive continuity strategy selection.

Question 42Business impact analysis and risk assessment

Which metric defines the maximum acceptable time a business process can be unavailable before unacceptable consequences occur?

  1. Recovery point objective (RPO)
  2. Mean time to repair (MTTR)
  3. Maximum tolerable downtime (MTD) Correct answer.
  4. Service level agreement (SLA)

Explanation

Maximum tolerable downtime represents the longest period a process can be out of service before the impact becomes unacceptable to the organization. It sets the outer boundary within which recovery must be achieved.

Question 43Business impact analysis and risk assessment

A recovery time objective (RTO) is best described as which of the following?

  1. The frequency at which backups are taken
  2. The target duration within which a process must be restored after disruption Correct answer.
  3. The cost of replacing failed hardware
  4. The volume of transactions that can be lost without penalty

Explanation

The RTO is the target elapsed time allowed for restoring a process or resource to service after an outage. It is derived from the MTD and is always shorter than or equal to that tolerance limit.

Question 44Business impact analysis and risk assessment

What does a recovery point objective (RPO) primarily specify?

  1. The interval between business continuity exercises
  2. The acceptable amount of data loss measured in time before a disruption Correct answer.
  3. The number of staff required to run a process
  4. The maximum number of alternate sites an organization may maintain

Explanation

The RPO defines how far back in time a recovery must restore data, effectively setting the maximum tolerable data loss. Backup and replication strategies are designed to meet this objective.

Question 45Business impact analysis and risk assessment

In risk assessment terms, risk is typically expressed as which combination?

  1. Number of employees and their locations
  2. Likelihood of an event and its consequence or impact Correct answer.
  3. Duration of an outage and the size of the backup team
  4. Cost of controls and their maintenance schedule

Explanation

Risk is conventionally characterized as the combination of the probability that a threat event occurs and the severity of the resulting impact. Multiplying or rating these two dimensions allows risks to be prioritized for treatment.

Question 46Business impact analysis and risk assessment

Which of the following is an example of a qualitative risk assessment technique?

  1. Discounting future losses to present value
  2. Assigning risk ratings using a high-medium-low matrix Correct answer.
  3. Computing expected monetary value of a scenario
  4. Calculating annualized loss expectancy in currency

Explanation

Qualitative techniques describe risk using relative scales such as high, medium, and low rather than precise monetary figures. A risk matrix that combines likelihood and impact ratings is a classic qualitative tool.

Question 47Business impact analysis and risk assessment

What is the purpose of identifying dependencies during a business impact analysis?

  1. To reveal internal and external resources a critical process relies on for recovery planning Correct answer.
  2. To determine the marketing budget for the coming year
  3. To establish the organization's tax reporting obligations
  4. To select which employees receive promotions

Explanation

Dependency mapping shows the people, suppliers, systems, facilities, and data that a critical process needs in order to function. Understanding these links prevents recovery plans from overlooking a single point of failure.

Question 48Business impact analysis and risk assessment

Which statement best describes a threat in the context of risk assessment?

  1. A weakness in a control that allows harm to occur
  2. The documented procedure for restoring a server
  3. Any potential cause of an unwanted incident that could harm assets or processes Correct answer.
  4. The monetary value of a lost transaction

Explanation

A threat is a potential source of harm, such as a flood, cyberattack, or supplier failure, that could exploit a vulnerability. It is distinct from the vulnerability itself, which is the weakness that a threat may exploit.

Question 49Business impact analysis and risk assessment

A process generates $400,000 in revenue per day. A disruption lasting two days would halt all revenue. What is the revenue impact of that outage?

  1. $800,000 Correct answer.
  2. $400,000
  3. $1,600,000
  4. $200,000

Explanation

Revenue impact equals daily revenue multiplied by the number of disrupted days, so $400,000 times two days yields $800,000. This figure feeds into the financial impact assessment used to justify continuity investments.

Question 50Business impact analysis and risk assessment

An organization's maximum tolerable downtime for a process is 12 hours, and its recovery time objective is set at 8 hours. Why is the RTO set below the MTD?

  1. To ensure backups are deleted more frequently
  2. Because regulations require every RTO to be exactly two-thirds of the MTD
  3. Because the RTO must always exceed the MTD
  4. To provide a safety margin so recovery is achieved before impact becomes unacceptable Correct answer.

Explanation

The RTO is deliberately set inside the MTD to create a buffer, so that unforeseen delays during recovery do not push the outage past the tolerable limit. This margin protects the business even if recovery runs slower than planned.