I85PREP
⌘ K
Lead Operational Resilience Manager study materials
Lead Operational Resilience Manager study resources

Lead Operational Resilience Manager practice questions

One question at a time. Build your Lead Operational Resilience Manager understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental concepts of operational resilience

Under the operational resilience approach promoted by regulators such as the UK PRA and FCA, what is the primary objective of identifying 'important business services'?

  1. To focus resilience investment on the services whose disruption would cause the most harm to consumers and market integrity Correct answer.
  2. To replace the firm's enterprise risk register with a single list of customer complaints
  3. To rank all services by revenue contribution so that marketing budgets can be allocated
  4. To determine which services can be outsourced to third parties without contractual controls

Explanation

Important business services are those whose failure would cause intolerable harm to consumers, market integrity, or the firm's viability, so they set the scope for impact tolerances and scenario testing. Revenue ranking, outsourcing decisions, and complaint handling are separate activities that do not define the resilience perimeter.

Question 2Fundamental concepts of operational resilience

An operational resilience framework sets an 'impact tolerance' for a service. What does this concept most precisely describe?

  1. The maximum level of disruption the firm is prepared to accept for that service, expressed in a measurable metric Correct answer.
  2. The longest outage any peer institution has experienced in the last decade
  3. The budget ceiling approved for resilience remediation in the annual plan
  4. The minimum service level guaranteed to customers in a commercial contract

Explanation

An impact tolerance is a firm's stated maximum tolerable level of disruption to an important business service, defined through a measurable outcome such as hours of downtime or number of failed transactions. It is a risk appetite statement, not a contractual guarantee, budget figure, or industry benchmark.

Question 3Fundamental concepts of operational resilience

Which statement best captures the relationship between operational resilience and traditional operational risk management?

  1. Operational resilience and operational risk management are identical because both are measured only through loss events
  2. Operational resilience extends operational risk thinking by focusing on the firm's ability to keep delivering services during and after severe disruption Correct answer.
  3. Operational risk management applies only to technology failures, while operational resilience applies only to people failures
  4. Operational resilience replaces operational risk management entirely once a firm designates important business services

Explanation

Operational risk management identifies and mitigates causes of loss, whereas operational resilience adds a service-centred, outcome-focused lens on whether critical services can continue through severe but plausible disruption. The two disciplines are complementary rather than mutually exclusive or identical.

Question 4Fundamental concepts of operational resilience

A resilience team maps the resources that support an important business service. Which item is best classified as a 'resource' in this mapping rather than as a 'process'?

  1. The nightly reconciliation routine performed by the operations team
  2. The complaint escalation procedure documented in the operations manual
  3. The customer onboarding workflow spanning three departments
  4. The core banking platform hosted in a third-party data centre Correct answer.

Explanation

In service mapping, resources are the tangible assets a service depends on, such as technology systems, people, facilities, data, and third parties. The other options describe processes or procedures, which are the activities that use those resources.

Question 5Fundamental concepts of operational resilience

What is the purpose of 'severe but plausible' scenario testing in an operational resilience programme?

  1. To estimate the firm's ability to remain within impact tolerances when a realistic extreme disruption occurs Correct answer.
  2. To confirm that the firm's existing controls always prevent any disruption from occurring
  3. To satisfy audit requirements by testing only the scenarios that previously resulted in losses
  4. To benchmark the firm's share price against peers during a market-wide downturn

Explanation

Severe but plausible scenarios stress the firm against disruptions that are extreme yet credible, allowing it to test whether it can stay within its impact tolerances and where remediation is needed. The goal is not to prove controls never fail, nor to focus only on historical loss events.

Question 6Fundamental concepts of operational resilience

Which outcome is the clearest indicator that a firm has embedded a mature operational resilience culture?

  1. Business service owners actively use resilience metrics when making change and investment decisions Correct answer.
  2. Impact tolerances are set to the maximum technically possible level to avoid ever breaching them
  3. Scenario testing is performed only after a disruption has already occurred
  4. Resilience is treated as a compliance project owned solely by the second line and reviewed once a year

Explanation

Embedding means resilience considerations are part of everyday decision-making by the people who own and run services, not a periodic compliance exercise. Ownership by the second line alone, reactive testing, and artificially inflated tolerances all signal weak embedding.

Question 7Fundamental concepts of operational resilience

In operational resilience terminology, what distinguishes a 'disruption' from an 'incident'?

  1. A disruption is always caused by a cyber attack, while an incident is always caused by a natural hazard
  2. A disruption refers to impaired delivery of a service to customers, while an incident is the event or trigger that causes it Correct answer.
  3. A disruption is measured in financial loss, while an incident is measured in reputational damage
  4. A disruption is internal to the firm, while an incident always involves a third party

Explanation

An incident is the triggering event, such as a system failure or cyber attack, whereas a disruption describes the resulting impairment to service delivery and the harm that follows. The terms are related but not interchangeable, and neither is tied to a single cause or impact type.

Question 8Fundamental concepts of operational resilience

A regulator asks a firm to demonstrate 'operational resilience by design'. Which practice best exemplifies this principle?

  1. Building redundancy, failover, and dependency diversity into new services before they go live Correct answer.
  2. Adding manual workarounds after each outage to restore service faster next time
  3. Delegating all resilience decisions to the outsourced technology provider
  4. Documenting impact tolerances only after the first year of live operation

Explanation

Resilience by design means engineering redundancy, diversity, and recoverability into services at the design stage rather than retrofitting fixes after failures. Post-hoc workarounds, delayed tolerance setting, and full delegation to a vendor all fall short of this principle.

Question 9Fundamental concepts of operational resilience

A payments service depends on a single cloud provider with no tested alternative. During dependency mapping, which resilience concern should the lead manager raise first?

  1. Whether the provider's logo appears correctly on customer statements
  2. Concentration risk arising from reliance on a single provider without a viable substitute Correct answer.
  3. The number of change requests the provider processed last quarter
  4. The provider's marketing spend relative to competitors

Explanation

Single-provider reliance without a tested exit or alternative creates concentration risk that can breach impact tolerances if the provider fails. The relevant question is substitutability and recoverability, not commercial or cosmetic details.

Question 10Fundamental concepts of operational resilience

A firm's impact tolerance for a mortgage application service is stated as 'no more than four hours of inability to accept new applications'. Which finding from a scenario test would constitute a breach?

  1. A test showing degraded statement downloads while applications continued normally
  2. A test showing the intake channel unavailable for six hours before restoration Correct answer.
  3. A test showing recovery of the application intake within three hours and fifty minutes
  4. A test showing a two-hour delay in back-office document archiving

Explanation

The tolerance is defined on the ability to accept new applications, so six hours of unavailability exceeds the four-hour limit and is a breach. The other findings either stay within the tolerance or affect activities outside the defined service outcome.

Question 11Fundamental concepts of operational resilience

During service mapping, a manager finds that a critical data set is maintained by a small team of three specialists with no documented procedures. Which resilience vulnerability does this most directly represent?

  1. Excessive automation of a manual control
  2. Redundant data storage across multiple locations
  3. Key person dependency combined with undocumented knowledge Correct answer.
  4. Over-investment in cross-training across the wider department

Explanation

A tiny specialist team without documented procedures creates key person dependency and knowledge concentration, both of which threaten continuity if those individuals are unavailable. Automation, cross-training, and redundant storage would all reduce rather than create this vulnerability.

Question 12Fundamental concepts of operational resilience

A resilience lead is designing a scenario test for a retail banking service. Which scenario is the strongest example of 'severe but plausible'?

  1. A hypothetical alien attack that destroys all global data centres permanently
  2. A single customer reporting an intermittent login error on a mobile app
  3. A routine software patch applied during a scheduled maintenance window
  4. A simultaneous loss of the primary data centre and the main third-party payment processor for 48 hours Correct answer.

Explanation

Severe but plausible means credible yet extreme, such as losing primary infrastructure and a key external provider at once for a defined period. Routine maintenance and isolated user errors are not severe, while alien attacks are not plausible.

Question 13Fundamental concepts of operational resilience

A firm discovers that its recovery objective for a critical trading platform is 24 hours, but the impact tolerance for the related service is 4 hours. What is the most appropriate management action?

  1. Remove the trading platform from the service map to avoid the mismatch
  2. Widen the impact tolerance to 24 hours so the recovery objective is met
  3. Record the gap in the risk register and take no further action because tolerances are aspirational
  4. Treat the gap as a resilience vulnerability and fund remediation to align recovery capability with the tolerance Correct answer.

Explanation

When recovery capability cannot meet the impact tolerance, the gap is a genuine resilience vulnerability that must be remediated through investment, design change, or contingency arrangements. Changing the tolerance to fit the weakness or ignoring the gap defeats the purpose of setting tolerances.

Question 14Fundamental concepts of operational resilience

Which activity best demonstrates the principle of 'testing for resilience' rather than merely 'testing for recovery'?

  1. Auditing that disaster recovery documentation was reviewed in the last twelve months
  2. Simulating a prolonged outage that degrades multiple dependencies while business teams continue serving customers Correct answer.
  3. Confirming that a failover script runs without error during a maintenance window
  4. Verifying that backups restore successfully in a controlled lab environment

Explanation

Resilience testing examines whether the business can keep delivering the service through a severe, multi-dependency disruption, not just whether technical recovery steps execute. Backup restoration, script checks, and document reviews are necessary but narrower recovery or assurance activities.

Question 15Fundamental concepts of operational resilience

A firm's important business services list was set three years ago and has not been reviewed since a major acquisition. What is the primary resilience risk of this omission?

  1. The list may omit newly acquired services that now carry significant customer or market impact Correct answer.
  2. The impact tolerances will become more accurate over time without review
  3. Regulators will automatically require the firm to exit the acquired business
  4. The firm may be over-investing in resilience for services it no longer operates

Explanation

An acquisition can introduce services and customer populations that fall within the resilience perimeter, so an unreviewed list may leave material services outside the framework. Review is needed to capture changes in the business, not to trigger automatic exits or improve tolerances passively.

Question 16Fundamental concepts of operational resilience

Which metric is most useful for a service owner to monitor whether an important business service is staying within its impact tolerance during a live incident?

  1. Number of audit findings closed in the previous financial year
  2. Elapsed time since the service became unavailable, tracked against the tolerance threshold Correct answer.
  3. Cumulative number of change requests raised against the service this quarter
  4. Percentage of staff who completed last year's resilience awareness training

Explanation

During a live incident, the service owner needs real-time indicators of how long the service has been impaired relative to the tolerance, so decisions can be escalated before the threshold is breached. Change volumes, training completion, and closed audit findings are lagging governance measures.

Question 17Fundamental concepts of operational resilience

A resilience manager argues that because a service is fully outsourced, the firm's accountability for its resilience is transferred to the provider. How should the lead manager respond?

  1. Disagree, because the firm remains accountable for the resilience of services it provides to customers regardless of outsourcing Correct answer.
  2. Disagree, because outsourced services can never be classified as important business services
  3. Agree, provided the contract includes a service level agreement of any kind
  4. Agree, because contractual transfer of operations removes the firm's regulatory obligations

Explanation

Outsourcing operations does not transfer regulatory accountability: the firm remains responsible for the resilience of the services it delivers to customers and must manage third-party risk accordingly. Contracts and service levels are controls, not a transfer of accountability.

Question 18Fundamental concepts of operational resilience

Which pair correctly distinguishes a 'preventive' resilience control from a 'recovery' control?

  1. Preventive: incident communications plan; Recovery: staff awareness training
  2. Preventive: post-incident review; Recovery: supplier due diligence
  3. Preventive: restoring from an offline backup; Recovery: diverse network routing
  4. Preventive: diverse network routing; Recovery: restoring from an offline backup after data corruption Correct answer.

Explanation

Preventive controls reduce the likelihood or impact of disruption before it occurs, such as diverse routing, while recovery controls restore service after failure, such as backup restoration. The other pairs either invert the categories or mix in unrelated governance activities.

Question 19Fundamental concepts of operational resilience

A firm defines impact tolerances but has no process for escalating a potential breach to senior management. Which element of the resilience framework is missing?

  1. A defined governance and escalation mechanism linking service monitoring to accountable executives Correct answer.
  2. A revised procurement policy for office supplies
  3. A larger marketing budget for customer communications
  4. An additional external audit of the firm's tax reporting

Explanation

Impact tolerances only work if monitoring feeds a clear escalation path to accountable senior executives who can authorise response actions before the threshold is breached. The other options concern unrelated commercial or assurance activities.

Question 20Fundamental concepts of operational resilience

A scenario exercise reveals that the firm's customer call centre cannot handle a 300% surge in enquiries during a payments outage. Which resilience lesson should be recorded?

  1. Customer-facing capacity is a dependency of the service outcome and requires surge planning Correct answer.
  2. The technology recovery objective should be shortened to zero hours
  3. The outage scenario should be removed from future testing because it produced uncomfortable findings
  4. Call centre performance is outside the scope of operational resilience

Explanation

Customer harm during disruption depends heavily on the firm's ability to communicate and handle enquiries, so surge capacity for contact channels is a genuine resilience dependency. The finding should drive surge planning, not be excluded from scope or used to justify unrealistic zero-hour recovery.

Question 21Fundamental concepts of operational resilience

A resilience lead must decide whether a newly launched digital wallet qualifies as an important business service. Which factor is least relevant to that determination?

  1. The colour scheme and branding of the wallet's user interface Correct answer.
  2. The number of customers who depend on the service for everyday payments
  3. The potential for harm to market integrity if the service fails
  4. The service's role in the firm's own ability to remain viable

Explanation

Designation depends on the harm a failure would cause to customers, market integrity, and the firm's viability, not on aesthetic or branding choices. The other factors map directly onto the standard designation criteria.

Question 22Fundamental concepts of operational resilience

Two business services share the same core database. A resilience analysis concludes that the database's recovery time objective is two hours, but service A tolerates only one hour of disruption while service B tolerates eight hours. What is the soundest conclusion?

  1. The shared dependency should be recovered to meet the strictest tolerance, because service A's limit binds the design Correct answer.
  2. Both tolerances should be averaged to produce a single firm-wide target
  3. Service B's tolerance should govern because it allows more recovery time
  4. The database should be excluded from service mapping since it supports more than one service

Explanation

When a shared resource supports services with different tolerances, recovery capability must satisfy the most demanding dependent service, otherwise service A breaches its limit. Averaging tolerances or letting the loosest service drive design would leave the stricter service unprotected.

Question 23Fundamental concepts of operational resilience

A firm's board asks how resilience investment should be prioritised when multiple important business services have tolerance gaps. Which approach is most defensible?

  1. Allocate budget equally across services to avoid internal disagreement
  2. Fund the cheapest remediation actions first regardless of which service they protect
  3. Prioritise by the severity and likelihood of consumer harm and market impact arising from each gap, alongside cost and feasibility Correct answer.
  4. Defer all investment until a regulator issues a formal enforcement notice

Explanation

Prioritisation should be risk-based, weighing the potential harm to consumers and markets from each tolerance gap together with cost and feasibility of remediation. Cheapest-first, equal-split, or wait-for-enforcement approaches ignore the relative severity of the exposures.

Question 24Fundamental concepts of operational resilience

A resilience manager proposes using only historical incident data to calibrate impact tolerances. What is the principal weakness of this approach?

  1. Historical incidents only ever affect third-party providers, not internal systems
  2. Historical incidents may not capture novel or emerging threats, so tolerances could be set too loosely for plausible future disruption Correct answer.
  3. Historical data is always inaccurate and should never inform resilience decisions
  4. Historical data cannot be quantified and therefore has no place in a governance framework

Explanation

Backward-looking data reflects what has already happened and can understate exposure to emerging threats such as new attack techniques or untested dependencies. Historical evidence is valuable but must be combined with forward-looking scenario analysis to calibrate tolerances credibly.

Question 25Fundamental concepts of operational resilience

A firm's resilience framework requires that any change to an important business service be assessed for resilience impact before implementation. A project team argues this adds delay. How should the lead manager justify the control?

  1. By noting that the assessment exists solely to satisfy the internal audit plan for the year
  2. By confirming that the control removes the need for any post-implementation testing
  3. By stating that change assessment applies only to technology projects, not business processes
  4. By explaining that change impact assessment prevents the introduction of undetected single points of failure and keeps recovery capability aligned with impact tolerances Correct answer.

Explanation

Change impact assessment catches new dependencies, single points of failure, and recovery gaps before they reach production, keeping the service within its impact tolerance. Its rationale is risk reduction, not audit convenience, and it does not replace post-implementation testing.

Question 26Fundamental concepts of operational resilience

In operational resilience, what is the primary purpose of setting an impact tolerance for an important business service?

  1. To allocate budget across the firm's IT infrastructure projects
  2. To record the historical frequency of outages experienced by the service
  3. To specify the exact technical recovery time for every underlying system
  4. To define the maximum level of disruption the service can cause to customers and markets before harm becomes unacceptable Correct answer.

Explanation

An impact tolerance expresses the maximum tolerable disruption to an important business service, framed around harm to customers, markets, and the firm itself. It is a business-level limit, not a technical recovery target, and it anchors mapping, testing, and investment decisions.

Question 27Fundamental concepts of operational resilience

Which statement best captures the relationship between an 'important business service' and the processes that support it?

  1. Important business services are defined at the level of individual teams rather than end-to-end outcomes
  2. Processes are only relevant to resilience when they are performed by third parties
  3. An important business service is delivered through one or more processes, and those processes are prioritised because of the service they support Correct answer.
  4. Each process is classified as important in its own right regardless of the services it supports

Explanation

Operational resilience starts from the end-to-end services provided to customers and markets, then traces the processes, people, technology, and dependencies that deliver them. Processes gain priority because of the important service they underpin, not independently.

Question 28Fundamental concepts of operational resilience

A firm's resilience policy states that it will map its important business services. Which element is essential to a complete service map?

  1. The marketing plan for the service over the next financial year
  2. The internal and external dependencies, including people, technology, data, and third parties, needed to deliver the service Correct answer.
  3. The profit and loss account attributed to the service
  4. A list of all employees who have worked on the service in the last five years

Explanation

Service mapping identifies the resources and dependencies required to deliver an important business service, including people, processes, technology, data, facilities, and third parties. This enables the firm to understand where vulnerabilities and concentration risks sit.

Question 29Fundamental concepts of operational resilience

What does the term 'severe but plausible' mean when selecting disruption scenarios for resilience testing?

  1. Scenarios that are extreme beyond realistic likelihood so that any outcome is acceptable
  2. Scenarios that are credible enough to happen and severe enough to challenge the firm's ability to stay within tolerance Correct answer.
  3. Scenarios that have already occurred at the firm within the past year
  4. Scenarios that only affect a single non-critical application for a short period

Explanation

Severe but plausible scenarios are chosen to be credible in likelihood while still being severe enough to stress the firm's ability to remain within impact tolerances. They test whether the firm can respond to realistic but demanding disruption, not merely replay past events.

Question 30Fundamental concepts of operational resilience

A resilience manager is documenting how a firm would continue to serve customers if a key supplier failed. Which concept describes the pre-agreed arrangements for maintaining or restoring the service within tolerance?

  1. The firm's recruitment and onboarding policy
  2. The firm's annual financial budget
  3. Business continuity and recovery plans that set out fallback arrangements and response actions Correct answer.
  4. The service's customer complaints procedure

Explanation

Business continuity and recovery arrangements describe the fallback options and actions the firm would take to keep delivering an important business service within its impact tolerance during disruption. They translate mapping and tolerance-setting into practical response capability.

Question 31Fundamental concepts of operational resilience

A firm identifies that a critical payment service relies on one data centre with no geographic redundancy. Which resilience response is most directly aimed at reducing this vulnerability?

  1. Introducing a geographically separate failover capability or validated alternative arrangement Correct answer.
  2. Increasing the marketing budget for the payment service
  3. Extending the payment service's customer terms and conditions
  4. Adding more staff to the customer service team

Explanation

Single points of failure such as a sole data centre are addressed by building redundancy or validated alternatives that allow the service to continue within tolerance. The response should directly reduce the identified concentration risk.

Question 32Fundamental concepts of operational resilience

A resilience lead is asked to explain why 'vulnerabilities' are recorded separately from 'risks' in the firm's framework. Which explanation is most accurate?

  1. Vulnerabilities are weaknesses in people, processes, technology, or dependencies that could impair a service, and they are assessed for how they would affect delivery within tolerance Correct answer.
  2. Vulnerabilities are financial exposures, whereas risks are operational events
  3. Vulnerabilities only exist in third-party arrangements, while risks only exist internally
  4. Vulnerabilities are the same as risks and are recorded separately only for administrative convenience

Explanation

In operational resilience, vulnerabilities are specific weaknesses or exposures in the resources and dependencies supporting a service. They are assessed for their potential to cause disruption and to push the service beyond its impact tolerance, which is a narrower focus than general enterprise risk.

Question 33Fundamental concepts of operational resilience

Which action best demonstrates that a firm is treating third-party dependency as part of its own operational resilience?

  1. Transferring all responsibility for continuity to the supplier's contract terms
  2. Including the supplier's service in impact tolerance setting, mapping, and scenario testing as if it were internal Correct answer.
  3. Relying on the supplier's own assurance statements without further review
  4. Removing the supplier from the service map because liability sits with the supplier

Explanation

A firm remains accountable for the resilience of services it provides, even when delivery depends on third parties. This means incorporating critical suppliers into tolerance setting, mapping, and testing rather than relying solely on contractual or supplier assurances.

Question 34Fundamental concepts of operational resilience

A firm's senior managers want assurance that resilience arrangements actually work. Which approach provides the strongest evidence?

  1. Collecting supplier self-certification forms annually
  2. Reviewing the policy document to confirm it has been approved
  3. Running scenario-based exercises that test the firm's ability to remain within impact tolerance and acting on the findings Correct answer.
  4. Confirming that all staff have read the resilience policy

Explanation

Assurance is strongest when it comes from exercising real capabilities against severe but plausible scenarios and demonstrating whether tolerances are met. Findings must then drive remediation, closing the loop between testing and improvement.

Question 35Fundamental concepts of operational resilience

A firm defines resilience roles but finds that during incidents no one is clearly accountable for deciding when to invoke fallback arrangements. Which governance weakness does this represent?

  1. An excessive reliance on scenario testing
  2. A shortage of third-party contracts
  3. An unclear decision-making authority and escalation path for resilience response Correct answer.
  4. A failure to document impact tolerances

Explanation

Effective resilience governance assigns clear accountability for incident decisions, including who can invoke fallback arrangements and when escalation occurs. Ambiguity here delays response and can cause the firm to breach its impact tolerance unnecessarily.

Question 36Fundamental concepts of operational resilience

Which statement best explains why operational resilience frameworks require firms to identify 'important business services' rather than assess all services equally?

  1. Regulators require that only profitable services be assessed
  2. Prioritisation focuses resources on services whose disruption would cause the greatest harm to customers and markets Correct answer.
  3. Important business services are those with the largest headcount
  4. All services carry identical harm, so prioritisation is only a presentational choice

Explanation

Prioritisation concentrates mapping, testing, and investment on services whose disruption would cause the most significant harm to customers, markets, or the firm. This makes resilience effort proportionate to potential impact rather than spread thinly across everything.

Question 37Fundamental concepts of operational resilience

A firm's service map shows that a critical function depends on a single individual with unique knowledge. Which vulnerability category does this most directly illustrate?

  1. A people and knowledge concentration risk Correct answer.
  2. A contractual liability exposure
  3. A technology capacity constraint
  4. A market liquidity risk

Explanation

Dependence on one individual with unique knowledge is a people-based concentration vulnerability. It threatens the firm's ability to maintain the service if that person is unavailable, and it should be addressed through documentation, cross-training, or succession arrangements.

Question 38Fundamental concepts of operational resilience

A resilience manager proposes measuring resilience maturity solely by counting the number of scenario tests completed each year. What is the main weakness of this measure?

  1. It is too difficult to count tests accurately
  2. It ignores the firm's financial performance
  3. It overstates the importance of impact tolerances
  4. It measures activity rather than whether tests demonstrated the firm could stay within tolerance and drove remediation Correct answer.

Explanation

Counting tests measures activity, not effectiveness. A meaningful measure considers whether exercises showed the firm could remain within tolerance, what vulnerabilities were exposed, and whether remediation was completed, which links testing to genuine resilience improvement.

Question 39Fundamental concepts of operational resilience

A firm has mapped its services and set impact tolerances but has not assessed whether its current capabilities can meet those tolerances. Which gap in the resilience cycle does this represent?

  1. A missing assessment of current resilience against tolerances, which should drive remediation Correct answer.
  2. A failure to identify important business services
  3. An excess of third-party dependencies
  4. A completed testing and remediation programme

Explanation

The resilience cycle moves from identifying services and tolerances to assessing whether existing capabilities can meet them, then testing and remediating gaps. Without the assessment step, tolerances remain aspirational statements disconnected from actual capability.

Question 40Fundamental concepts of operational resilience

A board asks why resilience should be considered during the design of a new service rather than only after launch. Which argument is most consistent with operational resilience principles?

  1. Design-stage resilience work removes the need for any ongoing monitoring
  2. New services are exempt from impact tolerance setting until they have operated for a year
  3. Design-stage decisions lock in dependencies and single points of failure that are costly or impossible to remove later, so resilience must be built in from the outset Correct answer.
  4. Post-launch testing is prohibited by resilience frameworks

Explanation

Architectural and sourcing choices made during design determine the dependencies and vulnerabilities a service will carry. Embedding resilience at design stage avoids locking in weaknesses that are expensive to remediate and supports the principle of resilience by design.

Question 41Planning operational resilience management framework

An organisation is defining the scope of its operational resilience management framework. Which approach best reflects the principle that scope should be anchored to the delivery of important business services rather than to organisational structure?

  1. Adopt the scope of the last internal audit plan to avoid duplication of effort
  2. Define scope around each legal entity so that accountability follows the corporate structure
  3. Limit scope to the IT estate because disruption risk is primarily technological
  4. Map important business services end-to-end across all supporting functions, people, technology and third parties Correct answer.

Explanation

Operational resilience frameworks are built around important business services, and those services typically cut across departments, systems and outsourced providers. Scoping by legal entity or by IT alone leaves interdependencies and third-party dependencies invisible, which is precisely what the framework exists to expose. Reusing an audit plan is not a scope-setting method because audit scope follows risk assessment, not service delivery.

Question 42Planning operational resilience management framework

Which statement best describes the role of an impact tolerance in an operational resilience framework?

  1. It is the internal audit rating assigned to a business continuity plan
  2. It is the financial loss threshold at which insurance cover is triggered
  3. It is the maximum tolerable level of disruption to an important business service, expressed in a measurable metric Correct answer.
  4. It is the recovery time objective agreed with each technology supplier in their contract

Explanation

An impact tolerance sets the outer boundary of acceptable disruption for an important business service and must be expressed in a metric the firm can actually measure, such as minutes of outage or number of failed transactions. Recovery time objectives are internal recovery targets that should sit inside the tolerance, not define it. Insurance triggers and audit ratings are unrelated concepts.

Question 43Planning operational resilience management framework

A resilience manager is designing the governance layer of the framework. Which arrangement most clearly provides independent challenge to the first line's resilience self-assessment?

  1. A steering committee composed only of the technology operations managers who run the systems
  2. A vendor assurance team employed by the outsourcing provider delivering the service
  3. A working group chaired by the head of the business line whose services are being assessed
  4. A second-line resilience function that reviews and challenges first-line assessments before they go to the board Correct answer.

Explanation

Independent challenge requires separation from the activity being assessed, which is the defining characteristic of the second line of defence. A group chaired by the assessed business line, the provider itself, or the operating managers lacks that separation. The resilience function should review and challenge before board reporting so that reported tolerances are credible.

Question 44Planning operational resilience management framework

Which artefact is the most appropriate primary output of a business impact analysis performed for operational resilience purposes?

  1. A list of all employees and their emergency contact details
  2. A schedule of upcoming penetration tests for critical applications
  3. A full asset register listing every server and application in the estate
  4. A ranked view of the harm a disruption would cause to each important business service over time, used to set tolerances Correct answer.

Explanation

For resilience purposes the business impact analysis must show how harm accumulates over time for each important business service, because that time-based view is what allows tolerances to be set. Asset registers, contact lists and test schedules are supporting inputs or separate workstreams. The impact analysis is about consequence, not inventory.

Question 45Planning operational resilience management framework

In a resilience framework, what distinguishes a 'severe but plausible' scenario from a worst-case scenario?

  1. It is a scenario restricted to cyber events because those are the most common cause of outages
  2. It is a scenario judged credible enough to warrant planning while still being significantly more severe than normal events Correct answer.
  3. It is the single most extreme event that could theoretically occur regardless of likelihood
  4. It is the scenario with the highest probability of occurrence in the next twelve months

Explanation

Severe but plausible scenarios balance credibility and severity so that testing produces useful, actionable insight. Worst-case scenarios are unbounded and often untestable, while highest-probability scenarios tend to be too mild to reveal structural weakness. Restricting scenarios to cyber events ignores other drivers such as people, premises and third parties.

Question 46Planning operational resilience management framework

A firm is building a self-assessment cycle into its resilience framework. Which design choice best supports continuous improvement rather than a one-off compliance exercise?

  1. Running the assessment once when the framework is first launched and archiving the results
  2. Requiring services to reassess against tolerances whenever material change occurs and at a fixed minimum frequency Correct answer.
  3. Delegating all assessment to the internal audit function on a three-year cycle
  4. Assessing only services that have experienced a disruption in the previous year

Explanation

Resilience is a moving target because services, dependencies and threat profiles change, so assessments must be triggered by material change as well as by a minimum calendar frequency. A single launch assessment quickly becomes stale, and audit is a third-line assurance activity rather than the owner of self-assessment. Assessing only recently disrupted services ignores latent vulnerability elsewhere.

Question 47Planning operational resilience management framework

Which of the following best explains why dependency mapping is a core component of an operational resilience framework?

  1. It reveals the people, technology, facilities and third parties a service relies on, exposing single points of failure Correct answer.
  2. It replaces the need for scenario testing by documenting all possible failures
  3. It confirms the accounting treatment of outsourced arrangements
  4. It produces the regulatory capital calculation for operational risk

Explanation

Dependency mapping traces the resources a service needs in order to function, which is how concentration and single points of failure become visible. Capital calculation, accounting treatment and scenario testing are separate activities that dependency mapping informs but does not perform or replace. Without mapping, tolerances cannot be translated into recovery plans.

Question 48Planning operational resilience management framework

What is the primary purpose of a lessons-learned review after a resilience testing exercise?

  1. To satisfy the testing requirement so the service can be marked compliant
  2. To determine which individuals should be disciplined for the exercise outcome
  3. To compare the firm's results with competitors' published testing outcomes
  4. To identify remediable weaknesses and assign owners and deadlines so the framework improves Correct answer.

Explanation

Lessons-learned reviews convert test findings into tracked remediation with clear ownership and dates, which is how the framework matures. The purpose is not disciplinary, nor is it a box-ticking exercise to close out a compliance item. Competitor comparison is not the objective of a post-test review.

Question 49Planning operational resilience management framework

A payments service has an impact tolerance of four hours of disruption. Its primary data centre fails and the disaster recovery site takes six hours to become operational. Which conclusion should the resilience manager draw?

  1. The gap is acceptable because six hours is within normal industry practice
  2. The tolerance is automatically met because a recovery site exists
  3. The recovery capability is outside tolerance and the recovery strategy or tolerance must be remediated Correct answer.
  4. The service should be removed from the important business services list

Explanation

A recovery capability that takes longer than the impact tolerance means the service would breach its tolerance in a realistic failure, which requires remediation of the strategy or a justified revision of the tolerance. The mere existence of a recovery site does not demonstrate tolerance is met. Industry norms do not override a firm's own stated tolerance.

Question 50Planning operational resilience management framework

A firm discovers that two important business services both depend on the same third-party cloud provider with no viable substitute. How should the framework treat this finding?

  1. As a concentration risk requiring escalation, contingency planning and board-level visibility Correct answer.
  2. As an acceptable position because cloud providers are inherently resilient
  3. As irrelevant because the provider holds its own certifications
  4. As a procurement issue to be resolved solely by the purchasing team

Explanation

Shared dependency on a single provider with no substitute is a concentration risk that can cause simultaneous failure of multiple important business services. The framework should escalate it, require contingency options and give it board visibility. Provider certifications and purchasing processes do not by themselves mitigate the concentration.