I85PREP
⌘ K
CBCLA study materials
CBCLA study resources

CBCLA practice questions

One question at a time. Build your CBCLA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Business Impact Analysis

In a business impact analysis, which metric expresses the maximum tolerable time a business process can be unavailable before the impact becomes unacceptable?

  1. Service level agreement (SLA) target
  2. Recovery point objective (RPO)
  3. Maximum tolerable downtime (MTD) Correct answer.
  4. Recovery time objective (RTO)

Explanation

Maximum tolerable downtime is the outer boundary of tolerable outage before unacceptable consequences occur; RTO is the internal recovery goal set inside that boundary. RPO concerns acceptable data loss measured in time, not outage duration. An SLA target is a contractual commitment rather than a BIA-derived tolerance.

Question 2Business Impact Analysis

A BIA team is determining the recovery point objective for a financial ledger system. Which question most directly establishes that value?

  1. How many staff are needed to operate the ledger after a disruption?
  2. How much transaction data can the organization afford to lose if the system fails? Correct answer.
  3. How long can the ledger remain offline before regulatory breach?
  4. Which alternate site will host the ledger during recovery?

Explanation

RPO is expressed as the acceptable amount of data loss, usually measured as a time interval before the failure. Asking how much transaction data can be lost directly sets that tolerance. Outage duration relates to RTO and MTD, staffing relates to resource requirements, and site selection is a recovery strategy decision.

Question 3Business Impact Analysis

Which activity belongs to the scope-setting phase of a business impact analysis rather than to the impact assessment itself?

  1. Calculating regulatory penalties for missed reporting deadlines
  2. Estimating reputational damage from a service failure
  3. Ranking processes by financial loss per day of outage
  4. Identifying which business units and processes the BIA will cover Correct answer.

Explanation

Scoping defines the boundaries of the BIA, including which units, processes, and locations are included. Ranking losses, estimating reputational harm, and calculating penalties all occur during impact assessment once scope is fixed.

Question 4Business Impact Analysis

During a BIA workshop, a department head insists their process is critical because 'everyone depends on it.' Which action best applies BIA discipline to this claim?

  1. Defer the decision to the IT disaster recovery team
  2. Accept the assertion and label the process tier one
  3. Exclude the process until an outage actually occurs
  4. Ask for quantified downstream effects and dependency evidence before assigning criticality Correct answer.

Explanation

BIA criticality must rest on evidenced impact, such as quantified downstream effects, dependencies, and time-based consequences. Accepting an unverified claim undermines prioritization, and neither IT nor waiting for an incident substitutes for business-side impact analysis.

Question 5Business Impact Analysis

A BIA records that a payment processing outage causes escalating financial loss that becomes unacceptable after four hours. Which term best describes that four-hour point?

  1. Maximum tolerable downtime Correct answer.
  2. Mean time to repair
  3. Availability target
  4. Recovery point objective

Explanation

The point at which impact becomes unacceptable defines the maximum tolerable downtime for that process. MTTR and availability targets are operational metrics, and RPO addresses data loss rather than outage duration.

Question 6Business Impact Analysis

When building a BIA questionnaire for line managers, which design choice most improves the reliability of the impact data collected?

  1. Limiting questions to IT infrastructure dependencies
  2. Collecting only qualitative statements without ranges
  3. Asking open questions about general feelings of risk
  4. Using consistent time-based scales for each impact category Correct answer.

Explanation

Consistent time-based scales let responses across processes be compared and aggregated into tiers. Purely qualitative or feeling-based answers are hard to compare, and restricting questions to IT dependencies omits business impacts the BIA exists to capture.

Question 7Business Impact Analysis

A BIA identifies that a customer portal outage would trigger contractual penalties after 12 hours and reputational harm after 24 hours. What is the correct interpretation for recovery planning?

  1. The RTO should be set within 12 hours to avoid the earliest unacceptable impact Correct answer.
  2. The RTO should be set at 24 hours because reputation matters most
  3. No recovery objective is needed until penalties are actually incurred
  4. The RPO should be set to 12 hours to prevent penalties

Explanation

Recovery objectives must be set inside the earliest point at which impact becomes unacceptable, which here is the 12-hour contractual threshold. Reputational harm at 24 hours does not extend the tolerance, RPO addresses data loss, and waiting for penalties defeats the purpose of planning.

Question 8Business Impact Analysis

Which dependency mapping output is most useful when a BIA must show how an outage in one process cascades to others?

  1. A roster of on-call staff telephone numbers
  2. A schedule of planned maintenance windows
  3. A list of software licenses held by each department
  4. A matrix of upstream and downstream process dependencies Correct answer.

Explanation

A dependency matrix captures which processes feed or rely on others, enabling cascade analysis of outage effects. License inventories, contact rosters, and maintenance schedules support operations but do not reveal process-to-process impact propagation.

Question 9Business Impact Analysis

A BIA analyst needs to express impact in financial terms for a warehouse process. Which approach is most defensible?

  1. Using the total annual revenue of the organization as the daily loss
  2. Multiplying the number of employees by an assumed hourly rate
  3. Estimating lost throughput, overtime, penalties, and expediting costs per day of outage Correct answer.
  4. Applying the same loss figure used for every other process

Explanation

Credible financial impact estimates combine the specific cost drivers a process outage creates, such as lost throughput, overtime, penalties, and expediting. Headcount math, company-wide revenue, or uniform figures do not reflect the process's actual cost behavior.

Question 10Business Impact Analysis

Which statement correctly distinguishes a business impact analysis from a risk assessment?

  1. The two are interchangeable because both produce a risk register
  2. The BIA quantifies consequences of disruption, while risk assessment estimates likelihood and threat exposure Correct answer.
  3. The BIA estimates threat likelihood, while risk assessment quantifies consequence over time
  4. The BIA focuses only on cyber threats, while risk assessment covers all hazards

Explanation

A BIA concentrates on the consequences of disruption over time and the processes affected, independent of how likely a disruption is. Risk assessment adds likelihood and threat analysis, and the two are complementary rather than interchangeable.

Question 11Business Impact Analysis

A BIA shows that a payroll process can tolerate only two days of downtime, but the current recovery capability requires five days. What is the most appropriate conclusion?

  1. The process should be reclassified as non-critical
  2. The RPO should be increased to five days
  3. The tolerance should be relaxed to five days to match capability
  4. A recovery gap exists that requires remediation or risk acceptance Correct answer.

Explanation

When recovery capability exceeds the tolerable downtime, the difference is a recovery gap that must be closed through remediation or formally accepted as risk. Changing the tolerance to fit capability inverts the analysis, and RPO is a separate data-loss measure.

Question 12Business Impact Analysis

Which time-based impact category should a BIA use to capture obligations to regulators that arise when a process is down past a reporting deadline?

  1. Regulatory and legal impact Correct answer.
  2. Reputational impact
  3. Operational impact
  4. Financial impact

Explanation

Missed statutory or regulatory reporting obligations fall under regulatory and legal impact, which tracks deadlines, fines, and sanctions. Operational impact covers process execution, reputational covers public trust, and financial covers monetary loss, though overlaps should be recorded separately.

Question 13Business Impact Analysis

A BIA interview reveals that a process has no documented manual workaround and its only system is single-sited. Which BIA conclusion is best supported?

  1. The process should be excluded from dependency mapping
  2. The process has high exposure because no workaround and no redundancy increase outage impact Correct answer.
  3. The process has low impact because no workaround exists
  4. The process requires no recovery objective until a workaround is written

Explanation

Absence of a workaround and lack of redundancy mean an outage translates directly into full process stoppage, increasing exposure and impact severity. Missing workarounds do not reduce impact, and they do not justify excluding the process from analysis.

Question 14Business Impact Analysis

Which output of a BIA most directly feeds the disaster recovery plan's backup frequency decisions?

  1. The list of process owners
  2. The maximum tolerable downtime for each process
  3. The recovery point objective for each supporting system Correct answer.
  4. The criticality tier of each business unit

Explanation

Backup frequency is driven by the recovery point objective, which defines acceptable data loss. MTD drives recovery time planning, tiers drive prioritization, and owner lists support governance rather than backup scheduling.

Question 15Business Impact Analysis

A BIA team aggregates individual process assessments into enterprise-level criticality tiers. Which practice best preserves accuracy during aggregation?

  1. Applying consistent scoring criteria and reviewing outliers before tiering Correct answer.
  2. Assigning every process to the top tier to be safe
  3. Averaging all impact scores so no process dominates
  4. Letting each department use its own scoring scale

Explanation

Consistent criteria make scores comparable, and outlier review catches errors or genuinely exceptional processes before tiering. Averaging hides severe impacts, over-tiering destroys prioritization value, and inconsistent scales prevent valid comparison.

Question 16Business Impact Analysis

What is the primary purpose of validating BIA results with business process owners before finalizing recovery strategies?

  1. To satisfy auditors that a meeting occurred
  2. To reduce the number of processes included in the BIA
  3. To confirm impact estimates and tolerances reflect actual business operations Correct answer.
  4. To transfer accountability for recovery to the owners

Explanation

Owner validation confirms that impact estimates, dependencies, and tolerances match how the business actually operates. It is not a mechanism for shifting accountability, shrinking scope, or merely documenting attendance.

Question 17Business Impact Analysis

A BIA shows a process would lose 40,000 currency units per hour of outage, with a linear loss pattern, and the organization tolerates no more than 200,000 units of loss. What maximum tolerable downtime does this imply?

  1. Two hours
  2. Eight hours
  3. Five hours Correct answer.
  4. Ten hours

Explanation

Dividing the tolerable loss of 200,000 by the 40,000 per hour loss rate yields five hours of tolerable downtime. The other values either misapply the arithmetic or ignore the stated loss rate.

Question 18Business Impact Analysis

Which scenario best illustrates a cascading impact identified through BIA dependency analysis?

  1. A single workstation fails and is replaced under warranty
  2. A server is patched during a scheduled maintenance window
  3. An email outage prevents order confirmations, which delays invoicing and cash collection Correct answer.
  4. A department hires a contractor to cover parental leave

Explanation

Cascading impact occurs when one process failure propagates to dependent processes, as when email loss delays confirmations, invoicing, and cash collection. Hardware replacement, routine patching, and staffing coverage are isolated events without process-to-process propagation.

Question 19Business Impact Analysis

A BIA states that a process has a maximum tolerable downtime of 8 hours but an RTO of 12 hours. What does this indicate?

  1. The RTO exceeds the tolerable downtime, creating an unacceptable recovery gap Correct answer.
  2. The objectives are consistent because RTO always exceeds MTD
  3. The process should be reclassified as non-essential
  4. The RPO must also be 12 hours

Explanation

An RTO must sit inside the maximum tolerable downtime; a 12-hour RTO against an 8-hour MTD means recovery would arrive after impact becomes unacceptable. RTO does not normally exceed MTD, and RPO is an independent data-loss measure.

Question 20Business Impact Analysis

Which data source is most appropriate for estimating the revenue impact of an outage in an online sales process?

  1. Facilities maintenance logs
  2. Historical transaction volume and average order value by hour Correct answer.
  3. Employee satisfaction survey results
  4. The organization's marketing budget

Explanation

Hourly transaction volume combined with average order value provides an evidence-based estimate of lost revenue per hour of outage. Surveys, facilities logs, and marketing budgets do not measure sales throughput.

Question 21Business Impact Analysis

During BIA scoping, a decision is made to exclude a legacy reporting process. Which justification is most consistent with sound BIA practice?

  1. The process owner is difficult to schedule for interviews
  2. The process has been formally decommissioned and no business activity depends on it Correct answer.
  3. The process was not included in last year's BIA
  4. The process is supported by older technology

Explanation

Exclusion is defensible when the process no longer exists or has no dependent business activity, which removes any impact to assess. Scheduling difficulty, technology age, and prior omission are not valid grounds for excluding an active process.

Question 22Business Impact Analysis

Which element should a BIA record for each critical process to support later recovery strategy selection?

  1. The names of all past vendors considered
  2. The full organizational chart
  3. The minimum resources and staffing needed to resume at a reduced level Correct answer.
  4. The marketing campaign calendar

Explanation

Recording minimum resource and staffing requirements lets planners match recovery strategies to what the process truly needs at a reduced level. Marketing calendars, vendor histories, and org charts do not define recovery requirements.

Question 23Business Impact Analysis

A BIA analyst finds that a process's impact grows slowly for the first three days and then rises sharply. How should this shape the recovery strategy discussion?

  1. Set the recovery objective to the longest tolerable period regardless of the curve
  2. Treat the process as non-critical because early impact is low
  3. Ignore the curve and use the industry average recovery time
  4. Set the recovery objective near the sharp rise, since earlier outage is tolerable Correct answer.

Explanation

When impact curves are shallow then steep, the tolerance point sits near the inflection where consequences escalate sharply, informing the recovery objective. Low early impact does not make the process non-critical, and ignoring the curve or using industry averages discards process-specific evidence.

Question 24Business Impact Analysis

Which governance element is most important to keep a BIA program current after its initial completion?

  1. A rule that only IT may revise BIA results
  2. A scheduled review cycle triggered by changes and elapsed time Correct answer.
  3. A policy that prohibits updates between audits
  4. A one-time sign-off stored in an archive

Explanation

BIA results decay as processes, dependencies, and technology change, so a scheduled review cycle plus change triggers keeps them valid. One-time sign-off, update prohibitions, and restricting revisions to IT all undermine currency and business ownership.

Question 25Business Impact Analysis

A BIA shows three processes each depend on the same single database. What is the most significant finding for recovery planning?

  1. The database should be excluded from dependency mapping
  2. The processes should each be assigned different criticality tiers
  3. The shared database is a common point of failure that concentrates impact across all three processes Correct answer.
  4. Each process can be recovered independently without coordination

Explanation

A shared dependency is a common point of failure, so its loss simultaneously affects every dependent process and concentrates impact. Independence assumptions, exclusion from mapping, and tiering differences do not address the shared exposure.

Question 26Business Impact Analysis

In a business impact analysis, which metric defines the longest time a business process can be unavailable before its impact becomes unacceptable?

  1. Maximum tolerable downtime (MTD) Correct answer.
  2. Recovery point objective (RPO)
  3. Recovery time objective (RTO)
  4. Mean time between failures (MTBF)

Explanation

The MTD expresses the outer limit of tolerable unavailability for a process, derived from when impact crosses an unacceptable threshold. RTO and RPO are recovery targets set within that limit, while MTBF is a reliability statistic for equipment.

Question 27Business Impact Analysis

Which statement best describes the role of impact categories in a BIA?

  1. They provide consistent dimensions, such as financial, regulatory, and operational, for rating the consequences of disruption Correct answer.
  2. They replace the need to interview process owners because categories are self-evident
  3. They group similar processes so that only one assessment is needed per group
  4. They define the technical recovery sequence used by infrastructure teams

Explanation

Impact categories give the BIA a common set of dimensions so that different processes can be rated and compared on the same basis. They structure the assessment of consequences but do not substitute for owner input or determine technical recovery steps.

Question 28Business Impact Analysis

A BIA team needs to decide which business processes fall within the assessment boundary. Which input is most relevant to that scoping decision?

  1. The list of production applications and the business services they support Correct answer.
  2. The backup retention schedule for the data center
  3. The vendor contract terms for the service desk tool
  4. The number of staff trained in first aid

Explanation

Scoping should start from the business services the organization delivers and the applications supporting them, so that in-scope processes are complete and traceable. Backup schedules, tool contracts, and unrelated staffing data do not define business scope.

Question 29Business Impact Analysis

Which party is normally accountable for confirming the accuracy of a process-level BIA assessment?

  1. The business process owner Correct answer.
  2. The external auditor
  3. The procurement officer
  4. The data center facilities manager

Explanation

The process owner understands how the process operates and bears accountability for the business consequences of its disruption, so they validate the assessment. Auditors may review methodology and facilities or procurement staff lack the operational knowledge.

Question 30Business Impact Analysis

A BIA records for each process the peak period when disruption would cause the greatest harm. Why is this information important?

  1. It determines the depreciation schedule for servers
  2. It identifies when recovery capability must be most available and when testing should avoid disruption Correct answer.
  3. It sets the salary band for the recovery team
  4. It replaces the need for an MTD because timing alone defines impact

Explanation

Knowing peak periods, such as month-end close or seasonal sales, tells planners when recovery capability matters most and when tests or changes should be scheduled carefully. It does not define compensation, asset depreciation, or substitute for an MTD.

Question 31Business Impact Analysis

Which BIA output most directly supports setting the recovery point objective for a transaction-processing system?

  1. The volume and value of transactions and the tolerable data loss stated by the process owner Correct answer.
  2. The number of staff who can operate the system
  3. The annual software license cost
  4. The physical floor space occupied by the servers

Explanation

An RPO reflects how much data the business can afford to lose, which requires understanding transaction volume, value, and the owner's tolerance. Staff counts, floor space, and license cost do not describe data-loss tolerance.

Question 32Business Impact Analysis

Which characteristic most distinguishes a critical business process in a BIA?

  1. It has the longest history of operation
  2. Its disruption causes severe impact within a short tolerable timeframe Correct answer.
  3. It is managed by the largest department in the organization
  4. It is the process with the largest number of documented procedures

Explanation

Criticality is determined by the severity and speed of impact when a process is disrupted, not by documentation volume, department size, or age. A process is critical when its outage quickly becomes unacceptable.

Question 33Business Impact Analysis

In a BIA, what does the term impact over time describe?

  1. The speed at which backup tapes degrade in storage
  2. The frequency of supplier audits
  3. The rate at which consequences grow as the duration of a disruption increases Correct answer.
  4. The schedule for patching operating systems

Explanation

Impact over time captures how consequences accumulate from the moment of disruption onward, often slowly at first and then sharply. This curve is what allows the tolerable downtime to be derived for each process.

Question 34Business Impact Analysis

A BIA analyst is estimating financial impact for a subscription service and has access to churn data, monthly recurring revenue, and customer complaint logs. Which combination best supports a defensible estimate?

  1. Complaint logs alone, because customer sentiment predicts all financial loss
  2. The number of support tickets closed per agent per day
  3. Churn data linked to past outages plus monthly recurring revenue to model lost and at-risk revenue Correct answer.
  4. Monthly recurring revenue alone, because revenue is the only financial measure

Explanation

A defensible estimate combines observed churn behavior during prior outages with revenue figures to quantify lost and at-risk income. Single measures or unrelated productivity metrics cannot capture the financial consequence.

Question 35Business Impact Analysis

A process owner reports that a disruption would breach a data protection regulation after 24 hours and would also delay internal management reports. How should the analyst treat these two consequences?

  1. Record both, weighting the regulatory breach as more severe and noting the reporting delay as a lower-tier impact Correct answer.
  2. Record only the regulatory breach because internal reporting has no impact
  3. Average the two into a single severity score
  4. Discard both because neither has a direct revenue effect

Explanation

The BIA should capture all material consequences and reflect their relative severity rather than collapsing them prematurely. A regulatory breach typically outranks an internal reporting delay, but the delay is still documented for completeness.

Question 36Business Impact Analysis

During dependency analysis, a BIA reveals that a payment process relies on a third-party clearing service with no contractual uptime guarantee. What is the most appropriate BIA conclusion?

  1. The process should be removed from BIA scope
  2. The dependency automatically becomes the process owner's responsibility to fix
  3. The dependency can be ignored because it is external to the organization
  4. The process carries elevated recovery risk and the dependency should be flagged for mitigation and recovery planning Correct answer.

Explanation

An unguaranteed external dependency increases the likelihood and duration of disruption, so it should be recorded and escalated into recovery strategy and vendor mitigation. It is not a reason to ignore or remove the process from scope.

Question 37Business Impact Analysis

A BIA shows that a distribution process can tolerate 16 hours of downtime, but the process depends on a system whose tested restore time is 30 hours. What should the analyst recommend?

  1. Reclassify the process as non-critical to close the gap
  2. Increase the MTD to 30 hours to match current capability
  3. Remove the dependency from the dependency map
  4. Treat the gap as a recovery deficiency and evaluate options such as alternate processing or improved recovery technology Correct answer.

Explanation

When tested recovery capability exceeds the tolerable downtime, a gap exists that must be closed through recovery strategy, not by redefining the business requirement. Adjusting the MTD or criticality to match capability would misrepresent the business need.

Question 38Business Impact Analysis

A BIA is being built for a hospital network with clinical and administrative processes. Which approach best handles the differing impact profiles across these areas?

  1. Delegate all ratings to the IT department
  2. Assess only clinical processes because administrative ones are never critical
  3. Apply a single financial threshold to all processes for consistency
  4. Use tailored impact criteria per area, such as patient safety for clinical and financial for administrative, while keeping a common rating scale Correct answer.

Explanation

Impact criteria should reflect the nature of each area, with patient safety central to clinical processes and financial or regulatory criteria for administrative ones, while a shared scale preserves comparability. A single financial lens or exclusion of administrative processes would distort results.

Question 39Business Impact Analysis

An analyst must determine the impact of losing a key supplier that provides a specialized component. Which BIA technique is most appropriate?

  1. Counting the number of employees in the procurement department
  2. Estimating impact from the supplier's stock price
  3. Mapping the supplier dependency to affected processes and modeling impact using inventory buffer and lead-time data Correct answer.
  4. Reviewing the supplier's marketing materials

Explanation

Supplier impact is assessed by tracing which processes depend on the component and using buffer stock and lead-time data to model when impact begins and how it grows. Marketing materials, internal headcount, and stock prices do not describe operational consequence.

Question 40Business Impact Analysis

A BIA team wants to compare impact ratings across processes assessed by different facilitators. Which practice most improves consistency?

  1. Allowing each facilitator to define their own rating scale
  2. Letting the loudest process owner set the standard
  3. Providing calibrated rating criteria with defined thresholds and examples, plus a review step Correct answer.
  4. Averaging all ratings regardless of the criteria used

Explanation

Consistency across facilitators comes from shared criteria with concrete thresholds and examples, reinforced by a review or calibration step. Letting scales vary or averaging incomparable ratings undermines comparability.

Question 41Business Impact Analysis

A BIA indicates that a process has an MTD of 4 hours and an RTO of 4 hours. How should this relationship be interpreted?

  1. The RTO should be increased to create a buffer
  2. The recovery target exactly meets the tolerable limit, leaving no margin for error Correct answer.
  3. The MTD is invalid because it equals the RTO
  4. The process is non-critical because the values match

Explanation

An RTO equal to the MTD means recovery must succeed exactly at the tolerable limit, with no slack for delays or failed attempts. Many organizations plan an RTO inside the MTD to preserve margin.

Question 42Business Impact Analysis

Which BIA finding most strongly suggests that a manual workaround should be documented as part of the recovery strategy?

  1. The process uses a modern cloud-hosted application
  2. The process owner has approved the current BIA
  3. The process has high transaction volume during peak periods
  4. The process can be performed manually for a limited period using trained staff and paper forms Correct answer.

Explanation

A viable manual workaround extends the effective tolerable downtime and should be documented so it can be activated and tested. High volume, modern hosting, or approval alone do not establish a workaround.

Question 43Business Impact Analysis

A BIA analyst discovers that two departments describe the same shared service with conflicting recovery priorities. What is the best next step?

  1. Adopt the priority from the department with the larger budget
  2. Average the two priority rankings
  3. Facilitate a joint review to reconcile the priorities using agreed impact criteria and document the agreed outcome Correct answer.
  4. Defer the decision indefinitely until the next annual review

Explanation

Conflicting priorities should be resolved through facilitated review against shared impact criteria, producing a documented agreement. Budget size, averaging, or indefinite deferral do not produce a defensible priority.

Question 44Business Impact Analysis

Which element of a BIA record is most useful for later prioritizing recovery tests?

  1. The physical address of the office
  2. The documented MTD and the gap between it and current recovery capability Correct answer.
  3. The date the process was first documented
  4. The name of the software vendor

Explanation

The size of the gap between tolerable downtime and demonstrated recovery capability indicates where testing and improvement are most urgent. Vendor names, office addresses, and documentation dates do not convey recovery urgency.

Question 45Business Impact Analysis

A BIA shows that a regulatory reporting process has a hard statutory deadline each quarter. How should the analyst express the time-based impact?

  1. As an impact that only matters at year end
  2. As irrelevant because regulatory deadlines are handled by legal staff
  3. As a gradual financial loss beginning immediately at disruption
  4. As a fixed point after which penalties and legal exposure begin, tied to the statutory deadline Correct answer.

Explanation

Statutory deadlines create a threshold effect in which impact becomes severe at a defined point rather than accumulating smoothly. The BIA should capture that fixed trigger and the consequences that follow it.

Question 46Business Impact Analysis

An organization wants to reduce BIA effort while maintaining coverage. Which approach best balances rigor and efficiency?

  1. Rely solely on a vendor-supplied default impact list
  2. Tier processes by preliminary criticality and apply deeper assessment to higher tiers Correct answer.
  3. Assess every process at identical depth regardless of size
  4. Assess only processes that use cloud services

Explanation

Tiering allows deeper analysis where impact is potentially greatest while using lighter assessment for lower-tier processes. Uniform depth wastes effort, and arbitrary or vendor-default criteria ignore organizational context.

Question 47Business Impact Analysis

A BIA finds that a customer-facing process would suffer rapid reputational damage within one hour of outage, while its internal financial loss grows slowly. What does this pattern imply for recovery strategy?

  1. Recovery should be prioritized around the one-hour reputational threshold even though financial loss is initially small Correct answer.
  2. No recovery action is needed until financial loss becomes significant
  3. The process should be reclassified as non-critical
  4. Financial loss should drive the strategy because reputation is unquantifiable

Explanation

Recovery priorities must reflect the earliest severe impact, which here is reputational harm at one hour, not the slower financial curve. Ignoring reputational impact or waiting for financial loss would allow serious damage to occur.

Question 48Business Impact Analysis

A BIA analyst must choose between using last year's impact ratings and re-interviewing owners after a major acquisition changed several processes. Which choice is most defensible and why?

  1. Reuse the ratings but relabel them as current
  2. Re-interview owners for materially changed processes because impact ratings must reflect current operations and dependencies Correct answer.
  3. Suspend the BIA until the next full annual cycle
  4. Reuse last year's ratings to preserve year-over-year comparability

Explanation

Impact ratings are only valid for the operating model they describe, so material changes such as an acquisition require re-assessment of affected processes. Preserving comparability or relabeling stale data would produce misleading results.

Question 49Business Impact Analysis

A BIA shows that three critical processes share a single authentication service. Which conclusion best reflects the significance of this finding?

  1. A single point of failure exists that can disrupt all three processes simultaneously and should drive shared recovery investment Correct answer.
  2. The three processes should be merged into one
  3. Each process can be recovered independently without concern
  4. The authentication service is unimportant because it supports no revenue directly

Explanation

A shared dependency creates correlated failure, so one outage can breach the tolerable downtime of several processes at once. This concentration should shape recovery investment and resilience decisions for the shared service.

Question 50Business Impact Analysis

A BIA produces process-level ratings, and leadership wants a single enterprise criticality view. Which practice best avoids distorting the aggregate?

  1. Rounding all ratings upward to be conservative
  2. Summing all process ratings to produce one enterprise score
  3. Applying a documented aggregation rule that preserves the highest-severity impacts and records assumptions Correct answer.
  4. Selecting the rating of the largest department as representative

Explanation

Aggregation should follow a documented rule that keeps severe impacts visible and records the assumptions behind the roll-up. Simple summation, department size, or uniform rounding can hide or exaggerate critical exposures.