GRC Business Continuity and Resilience 2 — Questions and Answers
Question 1: Which metric defines the maximum acceptable amount of data loss measured in time during a disaster?
- Recovery Time Objective (RTO)
- Recovery Point Objective (RPO) (Correct answer)
- Maximum Tolerable Downtime (MTD)
- Mean Time to Recover (MTTR)
Correct answer: Recovery Point Objective (RPO)
RPO specifies the point in time to which data must be restored, defining the maximum tolerable data loss window.
Question 2: A company activates its BCP after a hurricane destroys its primary data center. Which phase of the BCP lifecycle is this?
- Plan development
- Testing and exercises
- Plan activation and execution (Correct answer)
- Business impact analysis
Correct answer: Plan activation and execution
Plan activation and execution is the phase where the BCP is invoked in response to an actual disruption event.
Question 3: What is the primary purpose of a tabletop exercise in business continuity?
- To physically simulate failover to a hot site
- To discuss and walk through scenario responses without live systems (Correct answer)
- To measure actual RTO achievement
- To test backup restoration speed
Correct answer: To discuss and walk through scenario responses without live systems
Tabletop exercises are discussion-based sessions where team members talk through their responses to a hypothetical scenario.
Question 4: Which BCP component addresses how an organization will communicate with employees, customers, and stakeholders during a crisis?
- Crisis communication plan (Correct answer)
- Business impact analysis
- IT disaster recovery plan
- Risk register
Correct answer: Crisis communication plan
The crisis communication plan defines messaging, channels, and responsibilities for notifying all relevant parties during a disruption.
Question 5: A firm's BIA reveals that its order-processing system must be restored within 4 hours. This figure represents the:
- RPO
- MTD
- RTO (Correct answer)
- MTPD
Correct answer: RTO
RTO is the target duration within which a system must be restored after a disruption to avoid unacceptable consequences.
Question 6: Which type of alternate site provides fully operational infrastructure with real-time data replication and can be activated within minutes?
- Cold site
- Warm site
- Hot site (Correct answer)
- Mobile recovery site
Correct answer: Hot site
A hot site is a fully equipped and mirrored facility that can take over operations almost immediately after a failure.
Question 7: During a BCP review, a team identifies a supplier whose failure would halt production for 30 days. This represents which type of risk?
- Reputational risk
- Single point of failure in the supply chain (Correct answer)
- Residual risk
- Inherent risk only
Correct answer: Single point of failure in the supply chain
A single critical supplier with no backup represents a supply chain single point of failure that can cause extended disruptions.
GRC Business Continuity and Resilience 2
Which metric defines the maximum acceptable amount of data loss measured in time during a disaster?