I85PREP
⌘ K
PRM study materials
PRM study resources

PRM practice questions

One question at a time. Build your PRM understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Operational Resilience

In operational resilience planning, what does the term 'impact tolerance' most precisely describe?

  1. The maximum tolerable level of disruption to a business service, expressed as a measurable threshold Correct answer.
  2. The contractual penalty a vendor pays when it misses an agreed service level
  3. The total budget allocated to disaster recovery hardware and cloud failover capacity
  4. The time required to restore a single failed server from the latest backup image

Explanation

An impact tolerance sets the point beyond which harm to a business service and its stakeholders becomes unacceptable, and it must be expressed in measurable terms such as minutes of outage or number of failed transactions. It is a business-level threshold, not a technical recovery target or a vendor penalty.

Question 2Operational Resilience

A firm identifies the people, technology, data, facilities and third parties on which a critical business service depends. Which resilience activity does this describe?

  1. Conducting a post-incident root cause review
  2. Running a vulnerability scan of internet-facing hosts
  3. Mapping important business services and their dependencies Correct answer.
  4. Setting risk appetite for credit exposures

Explanation

Dependency mapping traces the resources and relationships that a critical or important business service relies on, so that vulnerabilities and single points of failure can be identified. It is a foundational step before scenario testing and impact tolerance setting.

Question 3Operational Resilience

Which metric represents the maximum acceptable time to restore a business process after disruption before the impact tolerance is breached?

  1. Recovery point objective
  2. Recovery time objective Correct answer.
  3. Service level target
  4. Mean time between failures

Explanation

The recovery time objective defines the target duration within which a process or system must be restored, and it should be set tighter than the impact tolerance so there is headroom. The recovery point objective instead describes tolerable data loss measured in time.

Question 4Operational Resilience

What is the primary purpose of conducting severe but plausible scenario testing in an operational resilience programme?

  1. To benchmark staff performance against industry salary surveys
  2. To reveal whether the firm could remain within its impact tolerances under stress and to expose gaps Correct answer.
  3. To satisfy auditors that documentation exists for every possible failure mode
  4. To calculate the insurance premium for the coming financial year

Explanation

Scenario testing uses severe but plausible events to challenge assumptions and demonstrate whether important business services can stay within impact tolerances. The output is evidence of gaps and remedial actions, not merely documentation or cost calculations.

Question 5Operational Resilience

Which statement best captures the concept of operational resilience as distinct from traditional business continuity?

  1. It replaces enterprise risk management with a single annual recovery exercise
  2. It focuses on preventing, adapting to, responding to and recovering from disruptions to important business services, including through change Correct answer.
  3. It concerns only the continuity of IT infrastructure and data centre operations
  4. It is limited to relocating staff to a standby site after a building becomes unavailable

Explanation

Operational resilience broadens business continuity by concentrating on important business services, setting impact tolerances, and investing in the ability to adapt and recover, including during change and in relation to third parties. It is not confined to facilities or IT and does not replace the wider risk framework.

Question 6Operational Resilience

Which of the following is the clearest example of a concentration risk in a firm's operational resilience profile?

  1. The firm holds cyber insurance covering third-party claims
  2. The firm conducts annual awareness training for all staff
  3. The firm has documented recovery plans for each of its important business services
  4. Three of five critical services depend on the same cloud region and the same single network provider Correct answer.

Explanation

Concentration risk arises when multiple important business services share a dependency, so a single failure can disrupt them simultaneously. Shared cloud regions and a single network provider create exactly this correlated exposure.

Question 7Operational Resilience

In resilience terms, what does 'situational awareness' require of an organisation during a disruption?

  1. A complete root cause analysis completed before any response actions are taken
  2. Automatic invocation of the disaster recovery plan for all technology events
  3. Timely detection, consolidated information and a shared understanding of the incident's severity and impact Correct answer.
  4. Escalation to the board for every incident regardless of severity

Explanation

Situational awareness is the ability to detect disruption quickly, assemble reliable information and maintain a common operating picture so that decisions match the severity of the event. It is about speed and shared understanding, not exhaustive analysis before acting.

Question 8Operational Resilience

Which element is essential for an incident response plan to be usable during a real operational disruption?

  1. Clearly assigned roles, decision authority and escalation triggers Correct answer.
  2. A list of every software licence held by the firm
  3. The full text of all supplier contracts
  4. A schedule of marketing campaign launches

Explanation

An incident response plan is only effective when people know their roles, who can make decisions and when to escalate. Without clear authority and triggers, response slows precisely when speed matters most.

Question 9Operational Resilience

A payments service has an impact tolerance of four hours. Its recovery time objective is three hours, but testing shows the actual restoration capability is six hours. What is the most appropriate conclusion?

  1. The recovery time objective should be deleted because testing is unreliable
  2. The service is outside tolerance in practice and remediation or additional resilience investment is required Correct answer.
  3. No action is needed because the recovery time objective is below the tolerance
  4. The impact tolerance should be raised to six hours to match observed capability

Explanation

Testing reveals a gap between the intended recovery objective and achievable capability, and the achievable six hours exceeds the four-hour tolerance, meaning stakeholders would suffer unacceptable harm. The correct response is to close the gap through remediation, not to redefine the tolerance to fit current weakness.

Question 10Operational Resilience

A firm's third-party register shows a critical analytics vendor has no tested exit plan and holds exclusive data formats. Which resilience concern is most directly raised?

  1. Constrained ability to substitute the provider or recover data if the provider fails Correct answer.
  2. Insufficient marketing of the vendor relationship
  3. Excessive diversification of the supplier base
  4. Overinvestment in vendor due diligence

Explanation

Absent exit arrangements and proprietary data formats create lock-in, so the firm cannot readily move or retrieve its data if the provider fails or withdraws. This is a substitutability and exit-planning weakness in third-party resilience.

Question 11Operational Resilience

During an incident, a firm's crisis team discovers that the business continuity plan lists an obsolete contact for a key outsourced provider. What is the most valuable lesson to capture in the post-incident review?

  1. The incident should not have been escalated to the crisis team
  2. Contact and dependency information must be validated regularly as part of plan maintenance Correct answer.
  3. Outsourcing should be prohibited for all critical activities
  4. The business continuity plan should be shortened to a single page

Explanation

Stale information in plans is a maintenance failure, so the lesson is to build regular validation of contacts and dependencies into the plan governance cycle. The review should improve the control environment rather than blame escalation or ban outsourcing.

Question 12Operational Resilience

Which approach best demonstrates that a firm's response arrangements work under realistic conditions?

  1. Running exercises that include senior decision-makers, external dependencies and degraded-system conditions Correct answer.
  2. Circulating the plan by email and asking staff to confirm they have read it
  3. Storing the plan on the same system that hosts the production service
  4. Reviewing the plan annually with no participants outside the resilience team

Explanation

Exercises test the interaction of people, decisions and dependencies under realistic constraints, which reading a document cannot do. Involving leadership and degraded conditions exposes coordination and decision-making gaps.

Question 13Operational Resilience

A firm classifies a service as 'important' because disruption would harm customers. Which factor most strengthens the case for prioritising investment in its resilience?

  1. The service has the oldest technology stack in the estate
  2. The service has the highest number of change requests per quarter
  3. The service cannot be substituted and harm escalates rapidly once the tolerance is breached Correct answer.
  4. The service is delivered by the largest number of internal teams

Explanation

Prioritisation should reflect the severity and speed of harm to stakeholders and the absence of alternatives, because these determine how quickly the tolerance is breached. Internal team counts, change volumes and stack age are indicators of complexity, not of harm severity.

Question 14Operational Resilience

What is the role of a business impact analysis in setting impact tolerances?

  1. It replaces the need for scenario testing once completed
  2. It quantifies how disruption affects stakeholders over time, informing where tolerances should be set Correct answer.
  3. It determines the market price of the firm's products
  4. It lists employee training requirements for the coming year

Explanation

A business impact analysis examines the consequences of disruption as time passes, which is the evidence base for choosing where a tolerance should sit. It complements rather than replaces scenario testing.

Question 15Operational Resilience

A firm relies on a single data centre with no geographic separation of backups. Which resilience weakness is most significant?

  1. Staff may lack training on the backup tool
  2. The firm may exceed its software licensing entitlements
  3. The data centre may fail an energy efficiency audit
  4. A localised physical event could destroy both production and recovery capability simultaneously Correct answer.

Explanation

Co-locating backups with production removes the geographic separation that makes recovery possible after a site-level event. The result is a correlated single point of failure affecting both primary and recovery capability.

Question 16Operational Resilience

Which governance arrangement best supports operational resilience across a large firm?

  1. Delegation of all resilience decisions to the IT operations team alone
  2. An annual meeting of department heads with no standing agenda
  3. A designated accountable executive with clear ownership of important business services and escalation to the board Correct answer.
  4. Assignment of resilience ownership to the internal audit function

Explanation

Resilience requires clear senior accountability and service-level ownership so that decisions, investment and escalation have a home. Board visibility ensures that tolerances and gaps are governed at the right level.

Question 17Operational Resilience

A firm's incident log shows repeated minor outages from the same batch job over several months. Which resilience practice is most relevant to prevent recurrence?

  1. Increasing the number of staff on the service desk
  2. Root cause analysis feeding a change to the underlying process or control Correct answer.
  3. Removing the incidents from the log to reduce reporting burden
  4. Raising the impact tolerance for the affected service

Explanation

Recurring incidents indicate a systemic defect that requires root cause analysis and a corrective change, not just repeated recovery. Fixing the underlying cause reduces both frequency and cumulative impact.

Question 18Operational Resilience

Which statement best explains why recovery point objectives matter for operational resilience?

  1. They specify the maximum time a service may be unavailable
  2. They define how much data loss is tolerable, which shapes backup frequency and replication design Correct answer.
  3. They set the contractual notice period for supplier termination
  4. They measure the frequency of component failures in production

Explanation

A recovery point objective expresses tolerable data loss in time and therefore drives how often data is backed up or replicated. It is distinct from restoration time and from contractual arrangements.

Question 19Operational Resilience

A firm discovers that a critical service depends on a small team whose only member with key knowledge is on extended leave. Which action most directly addresses this vulnerability?

  1. Extending the impact tolerance until the individual returns
  2. Suspending the service for the duration of the leave
  3. Outsourcing the entire service to a single new provider
  4. Documenting procedures and cross-training additional staff to provide succession cover Correct answer.

Explanation

Knowledge concentration in one individual is a people dependency risk, and documentation plus cross-training creates redundancy in capability. This allows the service to continue without that individual.

Question 20Operational Resilience

Which practice best supports the principle that resilience must be maintained through periods of significant change?

  1. Assessing resilience impact as part of change approval for critical services Correct answer.
  2. Requiring every change to be approved by the board
  3. Freezing all technology changes for the whole financial year
  4. Restricting resilience reviews to the annual planning cycle

Explanation

Change can introduce new dependencies or remove controls, so resilience impact should be assessed when changes affecting critical services are approved. Blanket freezes or board approval of every change are disproportionate and impractical.

Question 21Operational Resilience

In a resilience context, what distinguishes a 'severe but plausible' scenario from a worst-case scenario?

  1. It must be limited to events that have already occurred at the firm
  2. It excludes any scenario involving third-party failure
  3. It is credible enough to test realistically while still being extreme enough to challenge capability Correct answer.
  4. It is chosen primarily because it is cheap to simulate

Explanation

Severe but plausible scenarios sit between routine events and implausible extremes, so they stretch capability while remaining credible enough to generate meaningful decisions. Historical-only or cost-driven selection would weaken the test.

Question 22Operational Resilience

A firm outsources a critical process to a provider that subcontracts part of the work without informing the firm. What is the most significant resilience implication?

  1. The firm's visibility of dependencies and its ability to assure recovery are reduced Correct answer.
  2. The provider's staff become employees of the firm
  3. The firm's impact tolerance is automatically reduced
  4. The firm's regulatory capital requirement automatically increases

Explanation

Unreported subcontracting obscures the real dependency chain, so the firm cannot assess concentration, controls or recovery capability in the lower tiers. Loss of visibility undermines assurance and contingency planning.

Question 23Operational Resilience

A firm's tested recovery capability meets its recovery time objective, but the recovery time objective itself exceeds the service's impact tolerance. What does this indicate?

  1. The service is resilient because testing was successful
  2. The recovery objective is misaligned with the tolerance and the service design or targets must change Correct answer.
  3. The impact tolerance should be disregarded because it is hard to meet
  4. The firm should reduce testing frequency to save cost

Explanation

Meeting an objective that is itself too slow provides false comfort, because restoration would still occur after the point of unacceptable harm. Objectives must be derived from, and sit inside, the impact tolerance.

Question 24Operational Resilience

Which combination of measures most convincingly demonstrates end-to-end recovery capability for an important business service?

  1. Periodic confirmation from suppliers that they hold a certified management system
  2. Full-service failover testing that includes data integrity checks, third-party interfaces and manual workarounds Correct answer.
  3. Annual review of the recovery plan by the service owner alone
  4. Component-level backup restoration tests performed separately by each technology team

Explanation

End-to-end testing exercises the whole chain, including data integrity, external interfaces and the manual steps people would actually use, which is where recovery most often fails. Isolated component tests and paper assurances do not evidence integrated capability.

Question 25Operational Resilience

A firm's board asks why it should invest in resilience when recent incidents caused limited loss. Which argument is most consistent with operational resilience principles?

  1. Resilience spending should match the average cost of past incidents exactly
  2. Resilience investment is justified only after a loss has been recorded
  3. Impact tolerances address severe but plausible events whose consequences could far exceed recent experience, and remediation is cheaper before disruption Correct answer.
  4. Resilience is a compliance cost with no bearing on stakeholder harm

Explanation

Resilience planning is forward-looking and focuses on severe but plausible events, not just the historical loss record. Pre-emptive remediation protects stakeholders and is typically less costly than recovering from a severe disruption.

Question 26Operational Resilience

In operational resilience work, what is the primary purpose of defining impact tolerances for important business services?

  1. To determine the order in which IT systems should be patched during maintenance windows
  2. To replace the firm's existing recovery time objectives with a single firm-wide target
  3. To set the maximum tolerable level of disruption before harm to consumers and market integrity becomes unacceptable Correct answer.
  4. To calculate the exact financial loss a firm will suffer from each type of operational incident

Explanation

Impact tolerances express the level of disruption a firm could tolerate for an important business service before unacceptable harm arises. They are set from the perspective of harm to consumers and market integrity, not from internal system convenience. Recovery objectives and plans are then designed to keep the service inside those tolerances.

Question 27Operational Resilience

A firm maps the people, processes, technology, facilities and data that support an important business service. What is this mapping commonly called?

  1. Capital adequacy modelling
  2. Change advisory scheduling
  3. Service dependency mapping Correct answer.
  4. Vulnerability scanning

Explanation

Mapping the resources and dependencies behind an important business service is known as service dependency mapping. It reveals where a disruption could propagate and which assets matter most. The output feeds scenario testing and remediation planning.

Question 28Operational Resilience

Which outcome is the clearest sign that a firm has embedded operational resilience into business-as-usual governance?

  1. Resilience requirements are built into change approval, procurement and product design decisions Correct answer.
  2. A dedicated resilience team writes all incident reports without input from service owners
  3. The resilience programme is owned solely by the IT department and reported annually
  4. Resilience is reviewed only after a major outage triggers regulatory attention

Explanation

Embedding resilience means it becomes part of routine decision-making, such as change approval, procurement and product design. That ensures resilience is considered before risks materialise rather than after. Isolated ownership or reactive review indicates the discipline has not been embedded.

Question 29Operational Resilience

What does a lessons-learned review after an operational incident primarily aim to produce?

  1. A replacement business continuity plan written from scratch
  2. A revised marketing statement about the firm's technology investments
  3. A list of agreed corrective actions with owners and deadlines that reduce recurrence risk Correct answer.
  4. A disciplinary record identifying which individual caused the failure

Explanation

A lessons-learned review should convert findings into concrete corrective actions with clear ownership and deadlines. Its purpose is to reduce the likelihood or impact of recurrence, not to assign blame. Tracking those actions to closure is what makes the review meaningful.

Question 30Operational Resilience

Why do regulators expect firms to test their ability to remain within impact tolerances under severe but plausible scenarios?

  1. To satisfy an annual audit checkbox without operational change
  2. To confirm that documented plans exist in a binder
  3. To demonstrate that response and recovery capabilities actually work when stressed Correct answer.
  4. To benchmark the firm's IT spending against peers

Explanation

Testing against severe but plausible scenarios shows whether capabilities genuinely function under stress rather than merely existing on paper. It exposes gaps that can then be remediated before a real event. Document existence alone provides little assurance.

Question 31Operational Resilience

Which statement best describes the role of the board in a firm's operational resilience framework?

  1. The board approves the resilience strategy and holds management accountable for delivery Correct answer.
  2. The board delegates all resilience decisions permanently to a single vendor
  3. The board sets individual system recovery times without management input
  4. The board personally executes recovery procedures during an incident

Explanation

The board sets direction, approves the resilience strategy and holds executive management accountable for delivering it. It does not perform operational recovery tasks itself. Clear board oversight ensures resilience receives appropriate priority and resources.

Question 32Operational Resilience

What is the main purpose of an incident communication plan in operational resilience?

  1. To record staff holiday schedules for the coming year
  2. To specify how and when the firm will inform customers, regulators and other stakeholders during a disruption Correct answer.
  3. To list the technical specifications of the firm's backup servers
  4. To describe the firm's marketing campaign for new digital services

Explanation

An incident communication plan defines who communicates what, to which stakeholders, and within what timeframes during a disruption. Timely, accurate communication protects customers and maintains market confidence. It is distinct from technical recovery documentation.

Question 33Operational Resilience

Which factor most directly determines whether a business service should be classified as 'important' for operational resilience purposes?

  1. The size of the team that operates the service
  2. The age of the underlying technology platform
  3. The potential for disruption to cause harm to consumers or threaten market integrity Correct answer.
  4. The number of change requests raised against the service

Explanation

A service is important when disruption could cause harm to consumers or threaten the integrity of the market. That harm-based test is the defining criterion. Team size, platform age and change volume are operational indicators but not the classification test.

Question 34Operational Resilience

A firm's resilience plan assumes the primary trading platform will fail over to a secondary site within one hour. Testing reveals the failover actually takes five hours because a database replication step is undocumented. Which action best addresses the root cause?

  1. Increase the number of staff on the primary site during trading hours
  2. Remove the secondary site from the plan to reduce complexity
  3. Document and automate the replication step, then retest the failover Correct answer.
  4. Lower the impact tolerance to five hours so the test result is compliant

Explanation

The gap stems from an undocumented and manual replication step, so remediating that step and retesting addresses the root cause. Adjusting the tolerance to match a poor result inverts the logic of resilience planning. Removing the secondary site would increase rather than reduce risk.

Question 35Operational Resilience

A firm's critical service depends on a cloud provider that has suffered two regional outages in the past year. Which response most appropriately manages this concentration risk?

  1. Transfer all remaining services to the same provider to simplify management
  2. Stop monitoring the provider because it is externally certified
  3. Assume the provider's contractual service credits fully compensate for outages
  4. Assess the provider's resilience evidence and consider architectural diversification or tested contingency arrangements Correct answer.

Explanation

Managing concentration risk requires assessing the provider's actual resilience and reducing dependency through diversification or tested contingencies. Service credits compensate financially but do not restore service. External certification does not remove the need for ongoing monitoring.

Question 36Operational Resilience

During a severe incident, the crisis team must decide whether to invoke the business continuity plan. Which factor is most relevant to that decision?

  1. Whether the incident occurred during normal business hours
  2. Whether the plan document was recently reformatted
  3. Whether the incident has exceeded defined trigger thresholds and is likely to threaten an impact tolerance Correct answer.
  4. Whether the media has already reported on the event

Explanation

Invocation decisions should be driven by predefined trigger thresholds linked to impact tolerances and the likelihood of unacceptable harm. Predefined triggers enable timely, consistent escalation. Formatting, timing and media coverage are not reliable decision criteria.

Question 37Operational Resilience

A firm completes a scenario exercise and finds that its recovery capability meets the recovery objective for technology but customer call-handling capacity collapses. What does this reveal?

  1. The recovery objective for technology should be removed
  2. The scenario was invalid because technology recovered as planned
  3. End-to-end service recovery depends on more than technology and must include people and process capacity Correct answer.
  4. Customer service is not part of operational resilience

Explanation

The finding shows that technology recovery alone does not deliver service recovery; people and process capacity are equally essential. End-to-end testing exposes these cross-dependencies. The scenario is valuable precisely because it surfaced the gap.

Question 38Operational Resilience

A firm's third-party contract for a critical service lacks audit rights and exit provisions. Which risk does this create most directly for operational resilience?

  1. The firm will automatically breach its capital requirements
  2. The provider will be unable to invoice the firm correctly
  3. The firm's marketing team cannot advertise the service
  4. The firm cannot verify the provider's resilience or transition the service if the provider fails Correct answer.

Explanation

Without audit rights the firm cannot independently verify the provider's resilience controls, and without exit provisions it cannot transition the service if needed. Both directly undermine the firm's ability to protect the important business service. The other options are unrelated to contractual resilience safeguards.

Question 39Operational Resilience

Which data management practice most directly supports recovery within impact tolerances after a destructive incident?

  1. Relying on staff to reconstruct data manually from memory
  2. Deleting historical backups to reduce storage costs
  3. Storing all backups on the same storage array as production data
  4. Maintaining tested, isolated backups with defined recovery point and recovery time objectives Correct answer.

Explanation

Tested, isolated backups with defined recovery objectives allow the firm to restore data within tolerable timeframes. Isolation protects backups from the same event that damages production. Manual reconstruction is slow, error-prone and unlikely to meet tolerances.

Question 40Operational Resilience

A firm's incident response team is distributed across three time zones. Which arrangement best supports consistent, timely response at any hour?

  1. A single on-call rota limited to head office business hours
  2. Relying on email to reach the duty manager during weekends
  3. Deferring all decisions until the full crisis team reconvenes
  4. Follow-the-sun coverage with clear handover procedures and a single escalation authority Correct answer.

Explanation

Follow-the-sun coverage with structured handovers and a clear escalation authority ensures decisions can be made promptly at any hour. It prevents delays caused by waiting for a single time zone to wake up. Email and deferred decisions undermine timely response.

Question 41Operational Resilience

A firm's resilience testing programme consists only of tabletop discussions with no simulation of system or process failure. What is the main limitation?

  1. Tabletops are too expensive to run regularly
  2. Tabletops cannot involve senior management
  3. Tabletops are only useful for cyber scenarios
  4. Tabletops alone may not reveal whether recovery capabilities actually perform under real failure conditions Correct answer.

Explanation

Tabletop exercises test decision-making and coordination but do not prove that systems and processes recover as intended. A credible programme blends discussion-based and operational testing. Relying on tabletops alone can leave untested capability gaps.

Question 42Operational Resilience

A firm identifies that a key supplier holds exclusive data formats, making migration difficult. Which action best reduces this lock-in risk?

  1. Increase the volume of data stored with the supplier
  2. Extend the contract term to secure preferential pricing
  3. Reduce internal documentation of the supplier interface
  4. Require portable, standard data formats and maintain a tested exit plan before renewal Correct answer.

Explanation

Requiring portable formats and maintaining a tested exit plan directly reduces dependency and enables transition. Extending the contract or increasing stored data deepens lock-in. Reducing documentation makes exit harder still.

Question 43Operational Resilience

How should a firm treat a scenario that is judged severe but plausible when setting its testing programme?

  1. It should be documented but never exercised
  2. It should be replaced with an everyday minor incident scenario
  3. It should be ignored because it is unlikely to occur
  4. It should be tested because it represents a realistic stress that could threaten impact tolerances Correct answer.

Explanation

Severe but plausible scenarios are the core of resilience testing because they stress capabilities realistically without relying on implausible extremes. They reveal whether the firm can remain within tolerances under credible pressure. Documenting without exercising provides no assurance.

Question 44Operational Resilience

A firm's change management process allows major platform changes without any resilience impact assessment. Which consequence is most likely?

  1. The firm will automatically exceed its impact tolerances
  2. Resilience weaknesses may be introduced undetected, eroding the ability to stay within tolerances Correct answer.
  3. Changes will be cheaper to implement
  4. Regulators will require the firm to stop all change activity

Explanation

Without a resilience impact assessment, changes can introduce hidden single points of failure or reduce recovery capability. Over time this erodes the firm's ability to remain within tolerances. The other outcomes are neither automatic nor accurate descriptions of the risk.

Question 45Operational Resilience

Which measure best indicates that a firm's response arrangements are genuinely operational rather than theoretical?

  1. Staff can locate and execute their assigned roles and escalation steps under time pressure in an exercise Correct answer.
  2. The plan has been reviewed by an external lawyer
  3. The plan uses a consistent font and formatting
  4. The plan document is stored in a locked cabinet

Explanation

Operational readiness is demonstrated when staff can actually perform their roles and escalate correctly under time pressure. Exercises that simulate real conditions provide that evidence. Document storage, legal review and formatting do not show that arrangements will work.

Question 46Operational Resilience

A firm's impact tolerance for a settlement service is two hours, but its tested recovery capability is six hours. Which conclusion is most appropriate?

  1. The tolerance should be raised to six hours to reflect current capability
  2. The firm is operating outside its tolerance and must remediate or accept a formally governed exception Correct answer.
  3. The test result should be disregarded as unrealistic
  4. No action is needed because settlement services are rarely disrupted

Explanation

When tested capability exceeds the impact tolerance, the firm cannot remain within acceptable harm limits and must remediate or formally govern the gap. Raising the tolerance simply to match capability defeats the purpose of setting it from harm considerations. Disregarding the test removes the evidence needed for improvement.

Question 47Operational Resilience

A firm wants to show that a critical payment service can recover end-to-end after a severe scenario. Which evidence set is most convincing?

  1. A vendor's marketing brochure describing high availability
  2. A successful integrated exercise covering technology, people, data and third parties, with results tracked to closure Correct answer.
  3. An annual staff survey about confidence in the plan
  4. A list of backup servers maintained by the IT team

Explanation

End-to-end recovery evidence requires an integrated exercise that exercises technology, people, data and third-party dependencies together. Tracking findings to closure shows the firm acts on what it learns. Isolated artefacts such as brochures, surveys or server lists do not demonstrate recovery capability.

Question 48Operational Resilience

A firm's resilience investment is questioned because recent incidents caused limited loss. Which argument best justifies continued investment?

  1. Resilience spending guarantees that no incident will ever occur
  2. Operational resilience is primarily a marketing differentiator
  3. The absence of recent severe incidents does not reduce the potential impact of a severe but plausible event on customers and the market Correct answer.
  4. Resilience investment is required only after a regulatory enforcement action

Explanation

Low recent losses reflect the absence of a severe event, not the absence of exposure. Resilience investment protects against the potentially severe impact of plausible events on customers and market integrity. Guarantees and reactive or marketing framings misstate the rationale.

Question 49Operational Resilience

A firm discovers that a critical service relies on a single individual with unique knowledge of a legacy system. Which combination of actions most effectively reduces this key-person dependency?

  1. Require the individual to work longer hours and cancel leave
  2. Defer action until the individual announces retirement
  3. Outsource the entire service to a provider without transferring knowledge
  4. Document the knowledge, cross-train additional staff and test their ability to operate the system independently Correct answer.

Explanation

Reducing key-person risk requires capturing knowledge, building redundancy in skills and verifying that others can operate the system independently. Documentation without testing may not prove competence. Outsourcing without knowledge transfer simply relocates the dependency.

Question 50Operational Resilience

A firm's resilience testing reveals that a plausible scenario would breach an impact tolerance within 90 minutes, but its incident escalation requires two hours of management approval before invoking continuity arrangements. What is the most appropriate remediation?

  1. Require the crisis team to meet in person before any action
  2. Pre-authorise invocation at defined trigger thresholds so response can begin before formal approval is complete Correct answer.
  3. Extend the impact tolerance to three hours
  4. Remove the scenario from the testing programme

Explanation

Pre-authorising invocation at predefined triggers removes the delay that would cause a tolerance breach. The remediation targets the mismatch between response speed and tolerable disruption. Extending the tolerance or suppressing the scenario avoids the problem rather than solving it.