I85PREP
⌘ K
MBCP study materials
MBCP study resources

MBCP practice questions

One question at a time. Build your MBCP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Subject Area 1

Which document is the most widely used and accepted standard for business continuity management systems?

  1. ISO 27001
  2. ISO 22301 Correct answer.
  3. ISO 31000
  4. ISO 9001

Explanation

ISO 22301 specifies requirements for a business continuity management system (BCMS) and is the reference standard for BCMS certification. ISO 9001 addresses quality management, ISO 27001 information security, and ISO 31000 risk management.

Question 2Subject Area 1

In business continuity terminology, what does the acronym BIA stand for?

  1. Business Impact Analysis Correct answer.
  2. Business Incident Assessment
  3. Business Interruption Allowance
  4. Baseline Infrastructure Audit

Explanation

A Business Impact Analysis identifies time-sensitive business functions and the consequences of their disruption. It underpins recovery objectives such as RTO and RPO.

Question 3Subject Area 1

Which metric defines the maximum acceptable length of time a business function can be unavailable before its disruption causes unacceptable harm?

  1. Recovery Time Objective
  2. Recovery Point Objective
  3. Maximum Tolerable Period of Disruption Correct answer.
  4. Mean Time To Repair

Explanation

The Maximum Tolerable Period of Disruption (MTPD) is the longest time a function can be down before impacts become unacceptable. The RTO is the target time set within the MTPD to resume operations.

Question 4Subject Area 1

A company tolerates losing at most 15 minutes of transaction data in a disruption. Which objective does this describe?

  1. Service Level Objective of 15 minutes
  2. Maximum Tolerable Period of Disruption of 15 minutes
  3. Recovery Time Objective of 15 minutes
  4. Recovery Point Objective of 15 minutes Correct answer.

Explanation

The Recovery Point Objective (RPO) expresses the maximum acceptable data loss measured backward from the disruption. A 15-minute RPO drives backup or replication frequency of at least every 15 minutes.

Question 5Subject Area 1

What is the primary purpose of conducting a business impact analysis?

  1. To test whether backup generators start automatically
  2. To document the organizational chart and reporting lines
  3. To calculate the annual insurance premium for facilities
  4. To identify time-critical functions and quantify the consequences of their disruption Correct answer.

Explanation

The BIA determines which functions are time-sensitive and what operational and financial impacts follow from disruption. Its outputs set recovery priorities and inform RTO and RPO targets.

Question 6Subject Area 1

A risk assessment rates an event as high likelihood and high impact. According to typical risk treatment logic, what is the most appropriate response?

  1. Record the risk as low priority
  2. Defer the assessment until the next annual cycle
  3. Prioritize treatment to reduce or transfer the risk Correct answer.
  4. Accept the risk without further action

Explanation

Risks with high likelihood and high impact fall in the highest priority zone and should be treated promptly through mitigation, transfer, or avoidance. Acceptance is reserved for risks within tolerance.

Question 7Subject Area 1

Which statement best describes the relationship between a risk assessment and a business impact analysis?

  1. BIA must always be completed before any risk assessment begins
  2. They are identical activities performed by the same team
  3. Risk assessment applies only to IT systems, while BIA applies only to people
  4. Risk assessment evaluates likelihood and cause of disruption, while BIA evaluates consequence to the business Correct answer.

Explanation

Risk assessment focuses on what could cause disruption and how likely it is, while the BIA focuses on the operational and financial consequences of disruption. Together they inform strategy selection.

Question 8Subject Area 1

What is the main objective of a business continuity exercise program?

  1. To replace the need for a BIA
  2. To demonstrate that disruptions will never occur
  3. To satisfy auditors with paperwork
  4. To validate plans, build competence, and identify improvement opportunities Correct answer.

Explanation

Exercises test whether plans work in practice, develop team capability, and surface gaps for corrective action. They are a core element of the check and act phases of the BCMS.

Question 9Subject Area 1

Which exercise type typically involves the least disruption to live operations while still testing decision-making?

  1. Call-tree activation during a real outage
  2. Tabletop discussion exercise Correct answer.
  3. Full-scale live exercise
  4. Simulation with live failover of production systems

Explanation

A tabletop exercise gathers participants to walk through a scenario in discussion form, testing plans and decisions without affecting production. It is low cost and low risk, making it a common starting point.

Question 10Subject Area 1

What distinguishes a full-scale exercise from other exercise types?

  1. It is conducted solely by senior management
  2. It deploys actual resources and personnel in a simulated emergency Correct answer.
  3. It uses only written questionnaires
  4. It requires no scenario or objectives

Explanation

A full-scale exercise mobilizes real people, systems, and facilities against a simulated scenario to test end-to-end response and recovery. It is the most resource-intensive exercise type.

Question 11Subject Area 1

After an exercise reveals that the crisis team could not reach a key supplier, what is the most appropriate next step?

  1. Reassign blame to the individual who missed the call
  2. Archive the exercise report without changes
  3. Update contact arrangements and record a corrective action with an owner and due date Correct answer.
  4. Cancel future exercises to avoid similar findings

Explanation

Exercise findings should feed a corrective action process with clear ownership and deadlines, followed by verification. This closes the improvement loop required by the BCMS.

Question 12Subject Area 1

What does a business continuity strategy primarily determine?

  1. The marketing plan for the coming fiscal year
  2. The list of employees eligible for promotion
  3. The approach for continuing and recovering prioritized activities before a disruption occurs Correct answer.
  4. The audit schedule for financial controls

Explanation

The BC strategy defines how prioritized activities will be protected and recovered, such as alternate sites, redundancy, or manual workarounds. It is selected based on BIA and risk assessment outputs.

Question 13Subject Area 1

An organization's BIA shows a critical function with a two-hour RTO, but the current recovery strategy requires twelve hours. What does this indicate?

  1. There is a gap between required and achievable recovery that must be addressed Correct answer.
  2. The RTO should be relaxed to twelve hours to match the strategy
  3. The function should be removed from scope
  4. The BIA was conducted incorrectly by definition

Explanation

When the achievable recovery time exceeds the required RTO, a recovery gap exists. The organization must change the strategy, accept the risk formally, or revisit the requirement.

Question 14Subject Area 1

Which recovery strategy option involves the lowest ongoing cost but typically the longest recovery time?

  1. Hot site with continuous replication
  2. Active-active dual data centers
  3. Warm site with periodic data synchronization
  4. Cold site with basic infrastructure only Correct answer.

Explanation

A cold site provides space and basic utilities but little pre-installed equipment, so it is inexpensive to maintain yet slow to bring into service. Hot and active-active options cost more but recover faster.

Question 15Subject Area 1

What is the primary purpose of a crisis management team during a disruption?

  1. To perform routine payroll processing
  2. To coordinate strategic decisions, communications, and escalation at the organizational level Correct answer.
  3. To negotiate supplier contracts after recovery
  4. To replace the technical recovery teams

Explanation

The crisis management team provides strategic direction, prioritizes actions, and manages internal and external communications during an incident. Technical recovery is delegated to operational teams.

Question 16Subject Area 1

Which element is most essential for an effective emergency communications plan?

  1. Communication only after full recovery is achieved
  2. Restricting information to the crisis team indefinitely
  3. A single communication channel with no redundancy
  4. Pre-agreed messages, multiple contact channels, and defined spokespersons Correct answer.

Explanation

Effective emergency communications rely on pre-scripted messages, redundant channels, and clearly designated spokespersons to reach stakeholders quickly. Stakeholder trust depends on timely, accurate information.

Question 17Subject Area 1

Which term describes the process of returning business functions to their normal operating environment after temporary recovery measures?

  1. Standby
  2. Restoration Correct answer.
  3. Escalation
  4. Invocation

Explanation

Restoration (or recovery to normal) is the phase in which interim arrangements are dismantled and functions return to permanent facilities and systems. Invocation is the act of activating the plan.

Question 18Subject Area 1

Why should business continuity plans be treated as living documents?

  1. Because organizations, risks, and dependencies change and plans must stay current through review and maintenance Correct answer.
  2. Because regulations require annual printing
  3. Because only the newest employees should own them
  4. Because plans become legally void after six months

Explanation

Plans reflect a point-in-time view of the organization and its dependencies, so they must be reviewed and updated as structures, systems, and risks evolve. Regular maintenance keeps recovery capability credible.

Question 19Subject Area 1

A supplier provides a service that supports a time-critical activity. What is the most appropriate supply-chain continuity measure?

  1. Include the supplier's recovery capability in impact analysis and validate it through contractual requirements and testing Correct answer.
  2. Rely solely on the supplier's marketing materials
  3. Terminate all supplier relationships to eliminate dependency
  4. Assume the supplier is resilient without verification

Explanation

Dependencies on suppliers must be assessed in the BIA and risk assessment, then managed through contractual continuity requirements and joint testing. Assumptions about supplier resilience should be verified, not presumed.

Question 20Subject Area 1

Which set of activities best represents the sequence of the business continuity management lifecycle?

  1. Analyze, design, implement, validate, and continually improve Correct answer.
  2. Forecast, market, sell, and invoice customers
  3. Hire, train, promote, and retire staff
  4. Budget, purchase, deploy, and dispose of hardware

Explanation

The BCMS lifecycle follows a plan-do-check-act pattern: understanding the organization, determining strategy, implementing arrangements, validating through exercises, and embedding continual improvement. It is cyclical rather than a one-time project.

Question 21Subject Area 2

Which document is the primary reference for establishing and maintaining an organization's business continuity management system according to the ISO continuum of standards?

  1. ISO 22301 Correct answer.
  2. ISO 27001
  3. ISO 31000
  4. ISO 9001

Explanation

ISO 22301 specifies requirements for a business continuity management system (BCMS) and is the primary certifiable standard in the continuity family. ISO 9001 addresses quality, ISO 27001 information security, and ISO 31000 risk management.

Question 22Subject Area 2

What is the primary purpose of a business impact analysis (BIA) within a continuity program?

  1. To calculate insurance premiums for physical assets
  2. To document the organizational chart and reporting lines
  3. To identify time-sensitive activities and the consequences of their disruption Correct answer.
  4. To test recovery technology performance under load

Explanation

A BIA identifies the organization's prioritized activities and the impact of their disruption over time, yielding recovery time objectives and recovery point objectives. It is not a technical load test, an org chart, or an insurance exercise.

Question 23Subject Area 2

An organization defines a recovery time objective (RTO) of four hours for a critical order-entry system. Which statement best describes what this RTO represents?

  1. The interval between backup cycles
  2. The contractual notice period for declaring a crisis
  3. The maximum acceptable amount of data loss measured in time
  4. The target time to restore the activity after disruption Correct answer.

Explanation

RTO is the target duration within which an activity or resource must be restored after disruption to avoid unacceptable impact. Data loss tolerance is the recovery point objective, not the RTO.

Question 24Subject Area 2

In the ISO 22301 plan-do-check-act cycle, which activity belongs to the 'check' phase?

  1. Establishing continuity objectives
  2. Implementing continuity procedures
  3. Identifying legal requirements
  4. Exercising and reviewing performance Correct answer.

Explanation

The 'check' phase covers monitoring, measurement, internal audit, management review, and exercising to verify the BCMS performs as intended. Setting objectives, implementing procedures, and identifying requirements belong to planning and doing.

Question 25Subject Area 2

Which term describes the process of identifying, analyzing, and evaluating continuity risks to prioritized activities?

  1. Risk assessment Correct answer.
  2. Risk appetite
  3. Risk treatment
  4. Risk transfer

Explanation

Risk assessment is the overall process of risk identification, analysis, and evaluation. Risk treatment follows assessment, appetite is a tolerance threshold, and transfer is one treatment option.

Question 26Subject Area 2

Which of the following is a recognized alternate site strategy that provides equipment and infrastructure but requires the organization to supply its own systems and data?

  1. Hot site
  2. Warm site Correct answer.
  3. Mobile recovery unit
  4. Cold site

Explanation

A warm site provides facility and some infrastructure but requires the organization to install its own systems and restore data. A cold site offers only space and basic utilities, while a hot site is fully equipped and ready.

Question 27Subject Area 2

A continuity manager needs to validate that a newly documented recovery procedure can be executed by staff who did not write it. Which exercise type is most appropriate?

  1. Tabletop exercise
  2. Walkthrough exercise Correct answer.
  3. Simulation exercise
  4. Full-scale exercise

Explanation

A walkthrough has participants step through the plan and procedures in detail to confirm accuracy and usability. Tabletop exercises discuss scenarios, while full-scale and simulation exercises test operational execution.

Question 28Subject Area 2

An organization identifies a supplier whose failure would halt a prioritized activity but has no contractual continuity requirements. What is the most appropriate continuity action?

  1. Accept the risk because the supplier is external
  2. Add continuity and recovery clauses to the supplier agreement Correct answer.
  3. Rely on the supplier's public reputation
  4. Remove the activity from the BIA scope

Explanation

Supply chain continuity is managed through contractual requirements, service level agreements, and verification of supplier resilience. External status does not remove the dependency, and excluding the activity from the BIA would misrepresent impact.

Question 29Subject Area 2

Which element of a business continuity plan defines who has authority to declare a disruption and activate the plan?

  1. The recovery strategy section
  2. The activation and escalation criteria Correct answer.
  3. The communication plan
  4. The training schedule

Explanation

Activation and escalation criteria specify the thresholds, authorities, and decision paths for declaring an incident and invoking the plan. Communication plans address messaging, strategies address recovery methods, and training addresses competence.

Question 30Subject Area 2

During a disruption, a crisis management team must coordinate internal staff, regulators, and media. Which plan component primarily addresses this need?

  1. Business impact analysis
  2. Capacity management plan
  3. Crisis communication plan Correct answer.
  4. Recovery point objective

Explanation

The crisis communication plan defines stakeholders, message ownership, channels, and timing for internal and external communication during an incident. BIA, RPO, and capacity management address impact analysis, data loss, and resources respectively.

Question 31Subject Area 2

Which metric best expresses the maximum tolerable period of disruption for a prioritized activity?

  1. Maximum acceptable outage Correct answer.
  2. Mean time between failures
  3. Service level target
  4. Recovery point objective

Explanation

The maximum acceptable outage, also called maximum tolerable period of disruption, is the longest time an activity can be unavailable before impact becomes unacceptable. RPO concerns data loss, MTBF concerns reliability, and service level targets are performance commitments.

Question 32Subject Area 2

An organization completes its BIA and risk assessment but has not yet selected recovery strategies. What is the logical next step in the continuity lifecycle?

  1. Publish the crisis communication plan
  2. Select and document recovery strategies for prioritized activities Correct answer.
  3. Conduct a full-scale exercise
  4. Perform an internal audit of the BCMS

Explanation

After impact analysis and risk assessment establish requirements, the organization selects and documents recovery strategies that meet the derived RTOs and RPOs. Exercises, communication plans, and audits follow once strategies and plans exist.

Question 33Subject Area 2

A continuity program uses a single exercise type repeatedly and results show no improvement in recovery performance. Which action best addresses this weakness?

  1. Reduce exercise scope to save resources
  2. Delegate exercises entirely to the IT department
  3. Introduce varied exercise types with escalating complexity and corrective actions Correct answer.
  4. Increase the frequency of the same exercise

Explanation

A maturing exercise program uses a mix of discussion-based and operations-based exercises with increasing complexity, and it tracks corrective actions to closure. Repeating one exercise type or narrowing scope limits learning.

Question 34Subject Area 2

Which statement best distinguishes a business continuity plan from a disaster recovery plan?

  1. The continuity plan focuses on restoring technology, while disaster recovery covers people and processes
  2. The two plans are interchangeable and differ only in naming convention
  3. The disaster recovery plan replaces the need for a business impact analysis
  4. The continuity plan addresses the whole organization's prioritized activities, while disaster recovery focuses on technology and data recovery Correct answer.

Explanation

Business continuity planning addresses the organization's prioritized activities, people, facilities, and dependencies, whereas disaster recovery planning concentrates on restoring technology infrastructure and data. They are complementary, not interchangeable.

Question 35Subject Area 2

An organization's continuity objectives must be measurable and monitored. Which practice best supports this requirement?

  1. Recording only the number of incidents that occurred
  2. Relying on anecdotal feedback from staff after incidents
  3. Defining key performance indicators for continuity and reviewing them at management review Correct answer.
  4. Documenting objectives without assigned owners

Explanation

Measurable continuity objectives are supported by defined indicators, assigned ownership, and periodic review through management review. Anecdotal feedback, incident counts alone, and unowned objectives do not demonstrate monitoring of performance.

Question 36Subject Area 2

A continuity manager must decide whether to invest in redundant network links or accept a longer outage for a moderately critical system. Which analysis most directly informs this decision?

  1. Reviewing the organization's marketing plan
  2. Auditing the supplier's financial statements
  3. Measuring employee satisfaction scores
  4. Comparing the cost of the strategy against the financial and operational impact of the outage Correct answer.

Explanation

Strategy selection is a cost-benefit decision weighing the investment against the impact of disruption derived from the BIA and risk assessment. Marketing plans, satisfaction scores, and supplier financials do not directly compare recovery cost to outage impact.

Question 37Subject Area 2

An organization's BIA shows that two activities have identical RTOs but one depends on a single supplier with no alternate source. How should the continuity strategy differ?

  1. The supplier dependency should be excluded from risk assessment
  2. Both activities should receive identical strategies because their RTOs match
  3. The activity with the single-source dependency requires additional mitigation such as alternate sourcing or stockpiling Correct answer.
  4. The dependent activity should have its RTO relaxed to reduce cost

Explanation

Strategy selection considers dependencies and risk exposure in addition to RTOs; single-source dependencies warrant mitigation like alternate sourcing or buffer stock. Identical RTOs do not imply identical strategies, and relaxing RTOs or excluding dependencies would distort risk.

Question 38Subject Area 2

After an exercise reveals that a recovery procedure references a system that was decommissioned, which corrective action process is most appropriate?

  1. Log the finding, assign an owner, update the procedure, and verify the fix at the next review Correct answer.
  2. Discard the exercise results as invalid
  3. Wait until the next annual audit to address it
  4. Note the finding verbally and continue the exercise

Explanation

Exercise findings should enter a corrective action process with documented ownership, remediation, and verification to close the loop. Verbal notes, discarding results, or deferring to audit leave the deficiency unresolved.

Question 39Subject Area 2

Which consideration is most important when setting recovery point objectives for a transaction-processing system?

  1. The brand color used in customer communications
  2. The number of employees in the finance department
  3. The tolerable amount of data loss expressed in time Correct answer.
  4. The physical size of the data center

Explanation

The RPO expresses how much data loss, measured in time, the organization can tolerate, and it drives backup and replication design. Data center size, headcount, and branding do not determine data loss tolerance.

Question 40Subject Area 2

Which activity best demonstrates top management commitment to the business continuity management system?

  1. Approving the plan once and never reviewing it
  2. Integrating continuity objectives into business planning and providing resources Correct answer.
  3. Delegating all continuity decisions to a junior analyst
  4. Outsourcing the entire BCMS to a vendor

Explanation

Leadership commitment is demonstrated by integrating continuity into business planning, allocating resources, and reviewing performance. Delegation to junior staff, full outsourcing, and one-time approval do not show ongoing commitment.

Question 41Business Impact Analysis

What is the primary purpose of a business impact analysis (BIA) within a business continuity program?

  1. To identify time-sensitive business functions and the consequences of their disruption Correct answer.
  2. To document the recovery steps for each IT server in the data center
  3. To assign disciplinary responsibility after an incident occurs
  4. To calculate the insurance premium for physical assets

Explanation

A BIA determines which functions are time-sensitive and quantifies the operational and financial consequences of their disruption, which then drives recovery priorities. It is an analytical input to strategy selection, not a technical recovery procedure or a post-incident tool.

Question 42Business Impact Analysis

Which metric represents the maximum acceptable length of time a business function can be unavailable before its disruption becomes unacceptable?

  1. Recovery point objective (RPO)
  2. Mean time to repair (MTTR)
  3. Maximum tolerable period of disruption (MTPD) Correct answer.
  4. Recovery time objective (RTO)

Explanation

The MTPD is the total elapsed time a function can be disrupted before the impact becomes intolerable; recovery objectives are set within it. RTO and RPO are derived targets that must be shorter than the MTPD.

Question 43Business Impact Analysis

During a BIA, a team records the point in time to which data must be restored for an order-entry system. Which term describes this requirement?

  1. Business continuity plan
  2. Recovery point objective Correct answer.
  3. Recovery time objective
  4. Service level agreement

Explanation

The recovery point objective defines how much data loss, expressed as time, is acceptable and therefore the restore point required. It is a data-centric metric distinct from the time-based recovery of the function itself.

Question 44Business Impact Analysis

Which financial measure estimates the loss incurred for each unit of time that a business function remains unavailable?

  1. Total cost of ownership
  2. Return on investment
  3. Net present value
  4. Cost of downtime per unit time Correct answer.

Explanation

Impact analysis quantifies losses over time, so expressing loss as cost per unit of downtime allows comparison of functions and supports prioritization. The other measures are investment or valuation metrics unrelated to outage duration.

Question 45Business Impact Analysis

Which of the following is a commonly recognized category of impact assessed during a BIA?

  1. Office floor plan efficiency
  2. Regulatory or legal impact Correct answer.
  3. Employee satisfaction survey results
  4. Marketing campaign reach

Explanation

BIAs typically assess financial, operational, regulatory/legal, and reputational impacts. Regulatory or legal impact is a standard category because breaches of obligations can trigger penalties and sanctions.

Question 46Business Impact Analysis

Who is typically responsible for validating and approving the results of a business impact analysis?

  1. The facilities maintenance contractor
  2. The IT help desk supervisor
  3. The external audit firm alone
  4. The process owners together with senior management Correct answer.

Explanation

Process owners supply and confirm functional data, while senior management approves the prioritization because it commits resources and sets risk tolerance. Approval by those accountable for the business ensures the results are defensible.

Question 47Business Impact Analysis

A BIA shows a payment function can tolerate only four hours of downtime, but its current recovery capability is twelve hours. What is the most appropriate conclusion?

  1. The MTPD should be raised to twelve hours to match capability
  2. The function is adequately protected because twelve hours is within a day
  3. The RPO should be eliminated to reduce documentation
  4. A recovery gap exists and mitigation or strategy changes are required Correct answer.

Explanation

When recovery capability exceeds the tolerable period, a gap exists between requirements and capability that must be closed through additional mitigation or revised strategy. Adjusting the tolerance to match capability inverts the analysis and hides real risk.

Question 48Business Impact Analysis

Which approach is most appropriate for gathering BIA data across a large organization with many process owners?

  1. Reviewing last year's marketing plan
  2. Relying solely on IT monitoring logs
  3. Combining structured questionnaires with targeted interviews Correct answer.
  4. Interviewing only the chief executive officer

Explanation

Structured questionnaires provide broad, consistent coverage, while targeted interviews add depth and validate critical responses. Combining methods balances efficiency with accuracy across many functions.

Question 49Business Impact Analysis

In dependency mapping, a business function relies on an application that in turn relies on a database and a network link. What does this illustrate?

  1. A single-tier dependency with no recovery implications
  2. An RPO that is automatically satisfied
  3. A multi-tier dependency chain that must be traced for recovery planning Correct answer.
  4. A reputational impact category

Explanation

Dependency mapping traces the chain from business function through applications to infrastructure so that recovery of underlying components supports the function. Multi-tier chains reveal where a single failed component can disrupt the whole function.

Question 50Business Impact Analysis

A BIA team is prioritizing functions for recovery. Which combination best supports a defensible priority ranking?

  1. Impact over time and the function's dependencies on other functions Correct answer.
  2. Age of the supporting technology and vendor contract length
  3. Departmental budget size and headcount growth
  4. Number of staff assigned to each function and office location

Explanation

Prioritization should reflect the severity of impact across time and the interdependencies that determine whether a function can actually operate. These factors connect recovery sequencing to real business consequence.