DRI Certified Business Continuity Professional (CBCP) Exam — Questions and Answers

Question 1: In Business Continuity Management Certification, what role does conflict resolution & mediation play in ensuring client/stakeholder satisfaction?

It replaces the need for direct communication
It only matters during initial certification
It has no direct impact on stakeholder satisfaction
It builds trust through demonstrated competence and consistency (Correct answer)

Correct answer: It builds trust through demonstrated competence and consistency

Conflict Resolution & Mediation builds trust through demonstrated competence and consistency, which directly contributes to stakeholder satisfaction and confidence in the BCM professional.

Question 2: How does a business continuity strategy ensure preparedness for unforeseen disruptions?

By allocating funds for expansion.
By providing guidelines for managing unforeseen disruptions. (Correct answer)
By promoting new products.
By focusing solely on financial growth.

Correct answer: By providing guidelines for managing unforeseen disruptions.

A robust business continuity strategy ensures preparedness by establishing clear guidelines, procedures, and resources for managing unforeseen disruptions. It outlines how the organization will respond, recover, and resume operations, enabling a structured and effective approach when an incident occurs. This proactive planning minimizes chaos and impact.

Question 3: What is the significance of peer review in conflict resolution & mediation for BCM professionals?

It is only relevant for newly certified professionals
It is primarily used for disciplinary purposes
It replaces the need for self-assessment
It promotes accountability, knowledge sharing, and quality improvement (Correct answer)

Correct answer: It promotes accountability, knowledge sharing, and quality improvement

Peer review promotes accountability, knowledge sharing, and quality improvement by allowing BCM professionals to benefit from collective expertise and identify areas for growth.

Question 4: A manufacturing company's BIA shows that production line A generates $2M/day and production line B generates $200K/day. During limited recovery resources, which line should receive recovery priority?

The line with the shortest RTO regardless of revenue
Line B, because it is less complex to recover
Both lines simultaneously to avoid operational gaps
Line A, because it has the highest financial impact (Correct answer)

Correct answer: Line A, because it has the highest financial impact

Financial impact data from the BIA directly drives recovery prioritization, ensuring the highest-value processes are restored first.

Question 5: Which documentation practice is most important for strategic planning & goal setting in the BCM field?

Documenting only when legally required
Using informal notes instead of official records
Maintaining complete, accurate, and timely records (Correct answer)
Recording only successful outcomes

Correct answer: Maintaining complete, accurate, and timely records

Maintaining complete, accurate, and timely records is crucial for accountability, quality assurance, and legal compliance in strategic planning & goal setting.

Question 6: A company identifies that its customer service platform depends on both the CRM database and the telephony system. This relationship is best documented as a:

Residual risk item
Single point of failure
Cascading risk scenario
Process interdependency (Correct answer)

Correct answer: Process interdependency

Process interdependencies map how one function relies on others, which is critical for sequencing recovery efforts in a BIA.

Question 7: What role does a risk assessment play in the BCM strategy development?

It defines employee benefits.
It outlines customer service standards.
It defines the marketing strategy.
It helps identify and prioritize potential risks. (Correct answer)

Correct answer: It helps identify and prioritize potential risks.

A risk assessment plays a crucial role in BCM strategy development by systematically identifying, analyzing, and evaluating potential threats and vulnerabilities that could impact business operations. This process allows the organization to prioritize risks based on their likelihood and impact, enabling the development of targeted strategies to mitigate them effectively.

Question 8: Which risk assessment technique assigns probability and impact values on a numerical scale to calculate a composite risk score?

Quantitative risk analysis (Correct answer)
Qualitative risk analysis
Delphi technique
SWOT analysis

Correct answer: Quantitative risk analysis

Quantitative risk analysis uses numerical values for probability and impact to calculate measurable risk scores such as Annual Loss Expectancy (ALE).

Question 9: What is the primary purpose of performance metrics & kpi analysis in the context of Business Continuity Management Certification?

To replace established industry guidelines
To eliminate the need for ongoing training
To ensure consistent quality and professional accountability (Correct answer)
To reduce organizational costs exclusively

Correct answer: To ensure consistent quality and professional accountability

Performance Metrics & KPI Analysis in Business Continuity Management Certification primarily ensures consistent quality and professional accountability, forming the foundation of competent practice in this field.

Question 10: When implementing strategic planning & goal setting practices, what should a BCM professional prioritize first?

Speed of completion over thoroughness
Personal convenience and efficiency
Cost reduction at all levels
Compliance with established standards and protocols (Correct answer)

Correct answer: Compliance with established standards and protocols

Compliance with established standards and protocols must be the first priority, as it ensures safety, quality, and legal adherence in professional practice.

Question 11: What is the role of exercises in business continuity management?

To plan marketing campaigns.
To simulate crisis scenarios and test the response effectiveness. (Correct answer)
To monitor employee performance.
To evaluate the financial health of the company.

Correct answer: To simulate crisis scenarios and test the response effectiveness.

Exercises in business continuity management play a vital role in simulating crisis scenarios to test the effectiveness of the organization's response. These simulations, ranging from tabletop discussions to full-scale drills, provide a practical environment to evaluate the plan, identify weaknesses, and assess team readiness. They allow for learning and improvement in a controlled setting before a real incident occurs.

Question 12: In BCM, what does 'exercising the plan' mean versus 'testing the plan'?

Exercising tests technical systems; testing evaluates human decision-making
They are interchangeable terms with no meaningful distinction
Exercising is for senior management only; testing is for technical staff
Exercising involves practicing and validating procedures; testing formally evaluates whether specific capabilities meet defined standards (Correct answer)

Correct answer: Exercising involves practicing and validating procedures; testing formally evaluates whether specific capabilities meet defined standards

Exercising broadly validates procedures and team readiness through practice, while testing formally measures whether specific capabilities (e.g., RTO, RPO) meet pre-defined performance standards.

Question 13: A BIA reveals that a payroll processing system has an MTD of 72 hours. The BCM team should set the RTO:

Equal to the MTD at 72 hours
Greater than the MTD to allow buffer time
Independent of MTD based solely on IT capacity
Less than the MTD to ensure recovery before critical impact (Correct answer)

Correct answer: Less than the MTD to ensure recovery before critical impact

The RTO must be set less than the MTD so that recovery occurs before the organization reaches unacceptable impact levels.

Question 14: A gap analysis in BCM strategy development compares:

Budget allocated vs. budget spent on BCM
Current recovery capabilities against required recovery objectives (Correct answer)
Existing insurance coverage vs. estimated disaster losses
Number of trained staff vs. total employees

Correct answer: Current recovery capabilities against required recovery objectives

A gap analysis identifies where current recovery capabilities fall short of the RTOs and RPOs established by the BIA, highlighting areas needing investment.

Question 15: What is the role of the 'Public Information Officer (PIO)' during a crisis response?

Approving all financial expenditures during the incident
Coordinating mutual aid agreements with partner agencies
Serving as the authorized spokesperson and coordinating external communications (Correct answer)
Managing technical recovery of IT systems

Correct answer: Serving as the authorized spokesperson and coordinating external communications

The PIO manages all external communications, ensuring consistent, accurate messaging to media, public, and other stakeholders during an incident.

Question 16: Which recovery strategy involves moving workloads to a cloud environment during a disruption?

Cloud-based recovery (DRaaS) (Correct answer)
Work-from-home policy
Mutual aid agreement
Cold standby

Correct answer: Cloud-based recovery (DRaaS)

Disaster Recovery as a Service (DRaaS) leverages cloud infrastructure to provide scalable, on-demand recovery capacity when primary systems are disrupted.

Question 17: What is the purpose of a 'return to normal operations' phase in BCM?

To notify insurance carriers
To debrief the incident response team only
To systematically transition from recovery mode back to standard business operations once the disruption has ended (Correct answer)
To update the risk register

Correct answer: To systematically transition from recovery mode back to standard business operations once the disruption has ended

The return to normal operations phase provides a structured process for transitioning from recovery/continuity mode back to full standard business operations after the disruption has been resolved.

Question 18: Which element of a Business Continuity Plan details how critical suppliers will be engaged or substituted during a disruption?

Communications tree
IT disaster recovery appendix
HR response procedures
Supply chain continuity and vendor management section (Correct answer)

Correct answer: Supply chain continuity and vendor management section

The supply chain continuity and vendor management section of a BCP addresses how critical suppliers will be contacted, substituted, or managed to maintain operations during a disruption.

Question 19: Which best describes a 'tabletop exercise' in the context of crisis management?

A discussion-based session where participants talk through a scenario without deploying resources (Correct answer)
A full-scale physical simulation involving all staff and external agencies
A review of physical security controls at a facility
An unannounced test of emergency notification systems

Correct answer: A discussion-based session where participants talk through a scenario without deploying resources

Tabletop exercises are facilitated, discussion-based activities that walk participants through a hypothetical scenario to identify gaps without real-world resource deployment.

Question 20: An organization discovers that a critical supplier provides a component used in 90% of its products, with no alternative supplier available. This situation represents a:

Inherent risk
Single point of failure (Correct answer)
Risk appetite threshold
Residual risk

Correct answer: Single point of failure

A single point of failure is any element whose loss would cause a critical process to fail, and a sole-source supplier with no backup qualifies as one.

Question 21: What document should a critical supplier provide to demonstrate their BCM capability to your organization?

ISO 9001 quality management certificate
Annual financial report
Business Continuity Plan or Business Continuity Statement (Correct answer)
Environmental impact assessment

Correct answer: Business Continuity Plan or Business Continuity Statement

A supplier's Business Continuity Plan or Business Continuity Statement demonstrates their documented capability to maintain operations and service delivery during a disruption, providing assurance to dependent organizations.

Question 22: How should a business ensure continuity of operations during a crisis?

By shutting down all operations temporarily.
By reallocating resources and ensuring continuity of critical operations. (Correct answer)
By reducing production levels.
By focusing only on financial recovery.

Correct answer: By reallocating resources and ensuring continuity of critical operations.

To ensure continuity of operations during a crisis, a business must strategically reallocate resources and prioritize the continuation of critical operations. This involves identifying essential functions and then deploying available personnel, technology, and facilities to maintain these core activities. The goal is to minimize disruption to key services and mitigate the overall impact on the business and its stakeholders.

Question 23: How does continuing education relate to stakeholder communication & reporting for BCM certified professionals?

It is only needed when changing employers
It is required only for entry-level practitioners
It is optional and rarely impacts practice quality
It ensures professionals stay current with evolving standards and best practices (Correct answer)

Correct answer: It ensures professionals stay current with evolving standards and best practices

Continuing education ensures BCM professionals stay current with evolving standards, technologies, and best practices in stakeholder communication & reporting, maintaining competency throughout their careers.

Question 24: What does the term 'crisis escalation threshold' refer to in incident response?

The number of staff required to staff an emergency operations center
The point at which legal counsel must be notified
The maximum financial loss an organization can tolerate
Pre-defined criteria that trigger activation of a higher response level or team (Correct answer)

Correct answer: Pre-defined criteria that trigger activation of a higher response level or team

Escalation thresholds define specific conditions—such as impact severity or duration—that automatically trigger activation of the next tier of response.

Question 25: In BCM recovery operations, what does 'parallel processing' as a recovery strategy mean?

Running two IT systems simultaneously on the same hardware
Using parallel generators for power redundancy
Splitting recovery tasks between two teams
Operating both the primary and alternate environments concurrently until confidence is established that the primary can fully take over (Correct answer)

Correct answer: Operating both the primary and alternate environments concurrently until confidence is established that the primary can fully take over

Parallel processing involves running both the primary and alternate environments simultaneously to verify that the primary system performs correctly before fully decommissioning the alternate recovery setup.

Question 26: In Business Continuity Management Certification, what role does strategic planning & goal setting play in ensuring client/stakeholder satisfaction?

It only matters during initial certification
It has no direct impact on stakeholder satisfaction
It replaces the need for direct communication
It builds trust through demonstrated competence and consistency (Correct answer)

Correct answer: It builds trust through demonstrated competence and consistency

Strategic Planning & Goal Setting builds trust through demonstrated competence and consistency, which directly contributes to stakeholder satisfaction and confidence in the BCM professional.

Question 27: Which of the following BEST describes the relationship between BCM strategy and the Business Impact Analysis (BIA)?

BIA and strategy selection are independent parallel activities
Strategy selection determines which functions the BIA should analyze
BIA findings drive strategy selection by identifying critical functions and time requirements (Correct answer)
The BIA is conducted after strategy selection to validate choices

Correct answer: BIA findings drive strategy selection by identifying critical functions and time requirements

The BIA identifies critical processes, their dependencies, and recovery time requirements, which serve as the foundation for selecting appropriate continuity strategies.

Question 28: Which element should be included in an after-action report (AAR) following a BCM exercise?

Employee performance reviews conducted during the exercise
Identified gaps, corrective actions, owners, and target completion dates (Correct answer)
Financial performance metrics for the quarter
Marketing strategy adjustments based on exercise findings

Correct answer: Identified gaps, corrective actions, owners, and target completion dates

An AAR must document identified gaps, the corrective actions required, who is responsible for each action, and the target dates for completion to drive improvement.

Question 29: What is an 'alternate work site' in the context of BCM recovery strategies?

A backup data center only
A cloud-only recovery environment
An offshore outsourcing arrangement
A pre-arranged location where staff can perform critical business functions if the primary site is unavailable (Correct answer)

Correct answer: A pre-arranged location where staff can perform critical business functions if the primary site is unavailable

An alternate work site is a pre-arranged facility where employees can resume critical business functions when the primary work location becomes unavailable.

Question 30: Which risk assessment approach evaluates a supplier's financial stability, operational resilience, and BCM capability simultaneously?

ISO 9001 quality audit
Third-Party Risk Assessment (TPRA) (Correct answer)
Net Promoter Score (NPS) survey
Supplier Scorecard evaluation

Correct answer: Third-Party Risk Assessment (TPRA)

A Third-Party Risk Assessment (TPRA) evaluates suppliers across multiple dimensions — including financial health, operational resilience, and BCM capability — providing a holistic risk profile to inform sourcing decisions.

Question 31: Why should a business continuity plan be regularly tested and updated?

To ensure it aligns with the company's marketing goals.
To ensure it adapts to changing risks and operational needs. (Correct answer)
To increase production efficiency.
To evaluate financial performance.

Correct answer: To ensure it adapts to changing risks and operational needs.

Business continuity plans must be regularly tested and updated to remain effective. Organizations evolve, risks change, and technologies advance, so periodic testing reveals gaps and ensures the plan remains relevant, adaptable, and capable of addressing current operational needs and potential threats. This continuous improvement maintains preparedness.

Question 32: Which BCM standard provides internationally recognized guidance on Business Impact Analysis methodology?

PCI DSS
ISO 22301 (Correct answer)
NIST SP 800-53
ISO 27001

Correct answer: ISO 22301

ISO 22301 is the international standard for Business Continuity Management Systems and includes requirements and guidance for conducting a BIA.

Question 33: What does 'inject' mean in the context of a BCM exercise?

Injecting real system commands to test failover
Providing participants with the answer to a scenario question
Introducing a new complication or piece of information during the exercise to test participant response (Correct answer)
Adding new personnel to the exercise mid-way

Correct answer: Introducing a new complication or piece of information during the exercise to test participant response

An inject is a scripted event or message introduced during an exercise to drive the scenario forward and test how participants respond to evolving conditions.

Question 34: Why is it important to involve business units in the Business Impact Analysis process?

To ensure proper recovery and minimize disruption. (Correct answer)
To minimize costs in product development.
To improve employee satisfaction.
To create marketing strategies.

Correct answer: To ensure proper recovery and minimize disruption.

Involving business units in the Business Impact Analysis (BIA) process is crucial because they possess intimate knowledge of their operations, dependencies, and the true impact of disruptions. Their input ensures that recovery strategies are realistic, comprehensive, and effectively minimize downtime and financial losses, leading to a more robust business continuity plan.

Question 35: A BCM manager is designing an incident severity classification system. Which criteria set is MOST appropriate for determining severity?

Scope of impact, operational disruption, financial exposure, and life-safety risk (Correct answer)
Regulatory reporting deadline, IT system type, and vendor involvement
Time of day, department involved, and media attention level
Number of employees affected and geographic distance from headquarters

Correct answer: Scope of impact, operational disruption, financial exposure, and life-safety risk

Effective severity classification uses multi-dimensional impact criteria—operational, financial, and life-safety—rather than circumstantial factors like time or location.

Question 36: A Minimum Business Continuity Objective (MBCO) defines:

The lowest acceptable backup frequency
The minimum staff count needed to declare an emergency
The minimum level of services needed during disruption to satisfy stakeholders (Correct answer)
The minimum insurance payout required for recovery

Correct answer: The minimum level of services needed during disruption to satisfy stakeholders

MBCO specifies the minimum service or product output level an organization must maintain during a disruption to meet stakeholder expectations.

Question 37: What is a key factor to consider when determining the Maximum Tolerable Downtime (MTD) for a critical process?

Availability of a backup system.
The length of time employees can be away from work.
The potential business impact of the disruption. (Correct answer)
The cost of replacing the process.

Correct answer: The potential business impact of the disruption.

When determining the Maximum Tolerable Downtime (MTD) for a critical process, the most important factor is the potential business impact of its disruption. This includes financial losses, reputational damage, regulatory penalties, and operational consequences, which collectively define how long a process can be down before severe harm occurs to the organization.

Question 38: What is the significance of peer review in performance metrics & kpi analysis for BCM professionals?

It is only relevant for newly certified professionals
It replaces the need for self-assessment
It is primarily used for disciplinary purposes
It promotes accountability, knowledge sharing, and quality improvement (Correct answer)

Correct answer: It promotes accountability, knowledge sharing, and quality improvement

Peer review promotes accountability, knowledge sharing, and quality improvement by allowing BCM professionals to benefit from collective expertise and identify areas for growth.

Question 39: How does testing and simulating potential disruptions help the business continuity plan?

It increases sales during normal operations.
It improves employee satisfaction.
It reduces costs in business operations.
It ensures the plan’s effectiveness and employee preparedness. (Correct answer)

Correct answer: It ensures the plan’s effectiveness and employee preparedness.

Testing and simulating potential disruptions are vital for a business continuity plan because they validate the plan's effectiveness in a real-world scenario and ensure employee preparedness. These exercises identify weaknesses, allow for refinement, and build confidence in the team's ability to respond during an actual incident, making the plan robust.

Question 40: A company identifies that losing its customer database for more than 4 hours would be catastrophic. This threshold is known as the:

Maximum Tolerable Downtime (MTD) (Correct answer)
Recovery Point Objective (RPO)
Minimum Business Continuity Objective (MBCO)
Recovery Time Objective (RTO)

Correct answer: Maximum Tolerable Downtime (MTD)

MTD (also called Maximum Tolerable Period of Disruption) is the longest period an organization can survive without a critical function before consequences become unacceptable.

Question 41: What does 'Recovery Time Objective' (RTO) define in a BCM plan?

The maximum acceptable time to restore a business function after a disruption (Correct answer)
The number of staff required for recovery
The cost of recovery operations
The frequency of data backups

Correct answer: The maximum acceptable time to restore a business function after a disruption

RTO defines the maximum acceptable duration within which a business function must be restored following a disruption before unacceptable consequences occur.

Question 42: Which of the following would be a critical outcome of conducting a Business Impact Analysis?

Identification of critical functions and recovery priorities. (Correct answer)
Reduction in operational costs.
Improvement in employee morale.
Increase in market share.

Correct answer: Identification of critical functions and recovery priorities.

A critical outcome of conducting a Business Impact Analysis (BIA) is the clear identification of an organization's most critical business functions and the establishment of their recovery priorities. This information is essential for allocating resources, setting recovery objectives, and developing effective strategies to minimize disruption and ensure business resilience.

Question 43: What is the primary purpose of strategic planning & goal setting in the context of Business Continuity Management Certification?

To replace established industry guidelines
To reduce organizational costs exclusively
To eliminate the need for ongoing training
To ensure consistent quality and professional accountability (Correct answer)

Correct answer: To ensure consistent quality and professional accountability

Strategic Planning & Goal Setting in Business Continuity Management Certification primarily ensures consistent quality and professional accountability, forming the foundation of competent practice in this field.

Question 44: During plan development, 'plan maintenance' provisions are included PRIMARILY to:

Define who has legal authority during an emergency
Satisfy auditor requirements for documentation
Ensure the plan remains accurate and effective as the organization changes (Correct answer)
Reduce liability in the event of a failed recovery

Correct answer: Ensure the plan remains accurate and effective as the organization changes

Regular maintenance keeps the BCP aligned with organizational changes, technology updates, and lessons learned from tests and real events.

Question 45: Which technology trend is most likely to impact strategic planning & goal setting in the BCM field in coming years?

Reduction in the need for professional certification
Complete elimination of human professionals
Return to exclusively paper-based systems
Digital tools for enhanced data collection, analysis, and reporting (Correct answer)

Correct answer: Digital tools for enhanced data collection, analysis, and reporting

Digital tools for enhanced data collection, analysis, and reporting represent the most significant and practical technology trend impacting strategic planning & goal setting, augmenting rather than replacing professional expertise.

Question 46: What is 'maximum tolerable downtime' (MTD) or 'maximum tolerable period of disruption' (MTPD)?

The time required to restore IT systems
The longest period a business function can be disrupted before causing irreversible harm to the organization (Correct answer)
The duration of a continuity exercise
The average historical outage duration

Correct answer: The longest period a business function can be disrupted before causing irreversible harm to the organization

MTD/MTPD is the maximum duration a business function can be disrupted before the organization suffers consequences so severe they may threaten its survival.

Question 47: A scenario-based tabletop exercise is BEST suited for which purpose?

Testing technical system failover speeds
Evaluating decision-making and communication among leadership (Correct answer)
Verifying backup media restoration
Measuring physical evacuation times

Correct answer: Evaluating decision-making and communication among leadership

Tabletop exercises are discussion-based and ideal for evaluating leadership decision-making, inter-departmental communication, and policy gaps without operational disruption.

Question 48: What does the term 'Recovery Time Objective' (RTO) refer to in BCM?

The time it takes to develop a business continuity plan.
The time to restore data after a disaster.
The amount of time taken to train staff on disaster recovery.
The maximum time a business process can be disrupted. (Correct answer)

Correct answer: The maximum time a business process can be disrupted.

Recovery Time Objective (RTO) in Business Continuity Management refers to the maximum acceptable duration of time that a business process or function can be unavailable following a disruption. It dictates how quickly a system or function must be restored to avoid unacceptable business impacts, directly influencing the design of recovery strategies.

Question 49: What is a 'vital records program' in BCM?

A customer database backup
An employee credentials vault
A systematic approach to identifying, protecting, and ensuring access to records essential for business resumption and legal compliance (Correct answer)
A payroll management system

Correct answer: A systematic approach to identifying, protecting, and ensuring access to records essential for business resumption and legal compliance

A vital records program identifies and protects records essential for resuming critical functions and meeting legal, regulatory, and financial obligations after a disruption.

Question 50: What is a 'Minimum Business Continuity Objective' (MBCO)?

The lowest acceptable RTO
The maximum cost the organization will spend on recovery
The minimum level of services or products that must be delivered during a disruption to meet critical obligations (Correct answer)
The minimum number of staff needed in the office

Correct answer: The minimum level of services or products that must be delivered during a disruption to meet critical obligations

MBCO defines the minimum level of service or output that must be maintained during a disruption to satisfy critical stakeholder obligations and avoid unacceptable consequences.

Question 51: What is the key difference between a BCM 'policy' and a BCM 'plan'?

A policy is only for IT; a plan covers all departments
A policy sets organizational intent and direction; a plan provides specific procedures for responding to a disruption (Correct answer)
A plan is approved by regulators; a policy is internal only
There is no difference

Correct answer: A policy sets organizational intent and direction; a plan provides specific procedures for responding to a disruption

A BCM policy establishes organizational intent and governance direction, while a BCM plan provides the specific operational steps to respond to and recover from disruptions.

Question 52: Which BCM lifecycle phase involves reviewing program performance and identifying improvements?

Embedding and management
Initiation
Implementation
Ongoing program management and review (Correct answer)

Correct answer: Ongoing program management and review

Ongoing program management and review is the phase where BCM performance is assessed, lessons learned are incorporated, and continuous improvement occurs.

Question 53: Which recovery site strategy provides the fastest activation but is the most expensive?

Hot site (Correct answer)
Mobile recovery unit
Warm site
Cold site

Correct answer: Hot site

A hot site is a fully equipped, operational duplicate of the primary environment that can be activated almost immediately, but it requires the highest ongoing investment.

Question 54: Which BCM standard provides guidance specifically on exercising and testing business continuity arrangements?

ISO 22313 (Correct answer)
NFPA 1600
ISO 9001
ISO 27001

Correct answer: ISO 22313

ISO 22313 provides guidance on implementing the requirements of ISO 22301, including detailed guidance on exercising and testing BCM arrangements.

Question 55: What is the difference between a 'Business Continuity Plan' and a 'Disaster Recovery Plan'?

A BCP is required by law; a DRP is optional
A BCP focuses on maintaining critical business operations during disruption; a DRP focuses specifically on restoring IT systems and data (Correct answer)
A DRP covers all business functions; a BCP covers only IT
They are identical documents

Correct answer: A BCP focuses on maintaining critical business operations during disruption; a DRP focuses specifically on restoring IT systems and data

A BCP addresses the continuity of critical business functions during a disruption, while a DRP specifically addresses the technical recovery of IT systems, infrastructure, and data.

Question 56: Which of the following is a key component of crisis management?

Making informed decisions and communicating them to the team. (Correct answer)
Making decisions without consulting the team.
Increasing marketing efforts.
Managing financial performance during the crisis.

Correct answer: Making informed decisions and communicating them to the team.

A key component of crisis management is making informed decisions and effectively communicating them to the team. Decisions must be based on available information and assessments, rather than being reactive or impulsive. Transparent communication ensures that all team members are aligned, understand the chosen course of action, and can execute their responsibilities effectively to manage the crisis.

Question 57: What is 'business resumption planning' (BRP) specifically focused on?

Marketing communications post-incident
Financial loss recovery
The steps and resources required to resume disrupted business functions after a significant incident (Correct answer)
IT systems failover

Correct answer: The steps and resources required to resume disrupted business functions after a significant incident

Business resumption planning focuses specifically on the steps, resources, and procedures required to resume critical business functions following a significant disruption.

Question 58: Which phase of the incident response lifecycle focuses on limiting the spread and impact of an active threat?

Containment (Correct answer)
Recovery
Eradication
Preparation

Correct answer: Containment

Containment aims to stop an incident from worsening or spreading while the organization gathers information and plans further response steps.

Question 59: How does continuing education relate to conflict resolution & mediation for BCM certified professionals?

It is required only for entry-level practitioners
It ensures professionals stay current with evolving standards and best practices (Correct answer)
It is optional and rarely impacts practice quality
It is only needed when changing employers

Correct answer: It ensures professionals stay current with evolving standards and best practices

Continuing education ensures BCM professionals stay current with evolving standards, technologies, and best practices in conflict resolution & mediation, maintaining competency throughout their careers.

Question 60: Which stakeholder group is considered the PRIMARY source of information during BIA data collection interviews?

External auditors
IT infrastructure teams
Business process owners and department managers (Correct answer)
Executive leadership only

Correct answer: Business process owners and department managers

Business process owners and department managers have direct knowledge of operational dependencies, impact thresholds, and recovery requirements for their functions.

Question 61: In BCM, what is the function of an 'activation threshold' in a Business Continuity Plan?

The financial limit for recovery spending
The data volume threshold for backups
The predefined criteria or conditions that trigger formal activation of the BCP (Correct answer)
The minimum staff count needed to operate

Correct answer: The predefined criteria or conditions that trigger formal activation of the BCP

An activation threshold defines the specific conditions—such as outage duration, scope, or severity—that must be met before a BCP is formally invoked.

Question 62: Which document translates broad BCM strategies into specific, step-by-step operational instructions for staff?

Risk register
BCM policy statement
Business Impact Analysis report
Business Continuity Plan (Correct answer)

Correct answer: Business Continuity Plan

The Business Continuity Plan contains detailed procedures that operationalize recovery strategies for personnel during an incident.

Question 63: Which practice BEST reduces cognitive overload for incident responders during a high-stress crisis?

Providing responders with unlimited access to raw data feeds
Rotating responders out of roles every 30 minutes to maintain alertness
Using pre-approved checklists and decision trees that reduce in-the-moment analysis (Correct answer)
Requiring all decisions to be approved by committee before execution

Correct answer: Using pre-approved checklists and decision trees that reduce in-the-moment analysis

Checklists and decision trees allow responders to follow tested procedures under stress, reducing errors caused by cognitive overload without needing real-time analysis.

Question 64: What is the role of a 'recovery coordinator' during business resumption operations?

Directing and coordinating recovery activities across teams to ensure the BCP is executed effectively (Correct answer)
Managing the IT helpdesk
Performing all recovery tasks personally
Approving media statements

Correct answer: Directing and coordinating recovery activities across teams to ensure the BCP is executed effectively

A recovery coordinator directs, coordinates, and monitors recovery activities across multiple teams to ensure the BCP is executed in a timely and organized manner.

Question 65: What is the importance of communication in the BCM strategy?

To inform customers about new products.
To boost sales and revenue.
To ensure all employees and stakeholders are aligned and informed during disruptions. (Correct answer)
To promote company culture.

Correct answer: To ensure all employees and stakeholders are aligned and informed during disruptions.

Communication is paramount in a BCM strategy to ensure that all employees, stakeholders, and external parties are aligned, informed, and understand their roles during a disruption. Clear and consistent communication minimizes confusion, facilitates coordinated response efforts, and helps manage expectations, which is vital for effective crisis management.

Question 66: Which element of a crisis communication plan ensures messages remain consistent across multiple spokespeople and channels?

A social media blackout policy
Limiting communication to written press releases only
Requiring all statements to be approved by the legal department in real time
Approved key message frameworks with pre-cleared language and talking points (Correct answer)

Correct answer: Approved key message frameworks with pre-cleared language and talking points

Pre-approved key messages ensure that regardless of who is speaking or which channel is used, the organization's core narrative remains consistent and aligned.

Question 67: What is the primary benefit of conducting a Business Continuity Risk Assessment?

It identifies weaknesses in the IT infrastructure.
It identifies potential threats to the business’s ability to continue operating. (Correct answer)
It increases marketing effectiveness.
It helps with employee performance reviews.

Correct answer: It identifies potential threats to the business’s ability to continue operating.

The primary benefit of conducting a Business Continuity Risk Assessment is to systematically identify and evaluate potential threats and vulnerabilities that could disrupt critical business operations. This assessment helps an organization understand what risks it faces and how they might impact its ability to function, informing the development of mitigation strategies.

Question 68: During a functional exercise, which element distinguishes it from a full-scale exercise?

Functional exercises involve only senior management
Functional exercises use real equipment and personnel in the field
Functional exercises test specific functions without full field deployment (Correct answer)
Functional exercises require an external facilitator

Correct answer: Functional exercises test specific functions without full field deployment

Functional exercises test specific emergency management functions (e.g., communications, logistics) in a realistic but simulated environment without full field deployment of resources.

Question 69: What is the significance of peer review in strategic planning & goal setting for BCM professionals?

It is primarily used for disciplinary purposes
It promotes accountability, knowledge sharing, and quality improvement (Correct answer)
It replaces the need for self-assessment
It is only relevant for newly certified professionals

Correct answer: It promotes accountability, knowledge sharing, and quality improvement

Peer review promotes accountability, knowledge sharing, and quality improvement by allowing BCM professionals to benefit from collective expertise and identify areas for growth.

Question 70: What ethical consideration is most relevant to strategic planning & goal setting in BCM practice?

Prioritizing personal advancement over professional duties
Avoiding all professional development activities
Following only those rules that are convenient
Maintaining confidentiality and acting in the best interest of stakeholders (Correct answer)

Correct answer: Maintaining confidentiality and acting in the best interest of stakeholders

Maintaining confidentiality and acting in the best interest of stakeholders is the cornerstone ethical consideration for strategic planning & goal setting in professional practice.

Question 71: Which BCM standard provides internationally recognized guidance on business continuity management systems?

ISO 22301 (Correct answer)
BS 25999
NIST SP 800-34
ISO 27001

Correct answer: ISO 22301

ISO 22301 is the international standard specifying requirements for a Business Continuity Management System (BCMS).

Question 72: What is the PRIMARY goal of a 'lessons learned' session held after incident response activities conclude?

To satisfy regulatory reporting requirements
To assign accountability and issue formal reprimands
To improve plans, training, and processes to strengthen future response (Correct answer)
To calculate total incident costs for budget planning

Correct answer: To improve plans, training, and processes to strengthen future response

Lessons learned sessions are forward-looking improvement exercises designed to strengthen organizational resilience, not retrospective accountability hearings.

Question 73: Which factor most commonly causes BCM exercises to fail to achieve their objectives?

External facilitators unfamiliar with the organization
Poorly defined exercise objectives set before the event (Correct answer)
Insufficient budget allocation
Too many participants involved in the exercise

Correct answer: Poorly defined exercise objectives set before the event

Without clearly defined objectives, exercises lack focus, and it becomes impossible to evaluate success or identify specific gaps, making the exercise largely ineffective.

Question 74: Which of the following best describes a key competency required for performance metrics & kpi analysis in BCM certification?

Critical thinking and evidence-based decision making (Correct answer)
Memorization of all relevant regulations verbatim
Delegation of all complex tasks to supervisors
Ability to work independently without any oversight

Correct answer: Critical thinking and evidence-based decision making

Critical thinking and evidence-based decision making is essential for performance metrics & kpi analysis, as professionals must analyze situations and apply knowledge appropriately.

Question 75: What is 'work area recovery' (WAR) in BCM terminology?

IT systems failover procedures
The process of restoring a physical workspace with desks, phones, and workstations for displaced staff (Correct answer)
Customer notification procedures
Supply chain re-engagement

Correct answer: The process of restoring a physical workspace with desks, phones, and workstations for displaced staff

Work area recovery refers to restoring physical workspace environments—desks, telecommunications, and computing equipment—so that displaced employees can resume operations.

Question 76: Which exercise approach is MOST appropriate when an organization wants to test its plan with minimal disruption to daily operations?

Full-scale exercise
Simulation exercise
Surprise drill
Tabletop exercise (Correct answer)

Correct answer: Tabletop exercise

Tabletop exercises are discussion-based and require no operational disruption, making them ideal for testing plans when minimizing business impact is a priority.

Question 77: How does continuing education relate to strategic planning & goal setting for BCM certified professionals?

It is optional and rarely impacts practice quality
It ensures professionals stay current with evolving standards and best practices (Correct answer)
It is required only for entry-level practitioners
It is only needed when changing employers

Correct answer: It ensures professionals stay current with evolving standards and best practices

Continuing education ensures BCM professionals stay current with evolving standards, technologies, and best practices in strategic planning & goal setting, maintaining competency throughout their careers.

Question 78: An organization's BIA identifies that manual workarounds can sustain a billing function for up to 48 hours. This capability is best described as:

Interim continuity measure (Correct answer)
Residual risk tolerance
Recovery workaround capacity
Business continuity strategy

Correct answer: Interim continuity measure

Interim continuity measures (or workarounds) allow a function to continue operating at reduced capacity during a disruption until full recovery is achieved.

Question 79: What is 'mutual aid' in the context of crisis and emergency management?

Pre-arranged agreements between organizations to share resources during emergencies (Correct answer)
Internal cross-departmental budget reallocation during an incident
Government grants awarded to rebuild critical infrastructure
Financial assistance provided by insurers after a declared disaster

Correct answer: Pre-arranged agreements between organizations to share resources during emergencies

Mutual aid agreements allow organizations or jurisdictions to request and receive resources—personnel, equipment, supplies—from partners during emergencies they cannot handle alone.

Question 80: When developing a supply chain continuity strategy, which approach BEST reduces single-supplier dependency?

Negotiating longer contracts with the primary supplier
Increasing safety stock inventory levels
Requiring suppliers to carry BCM certification
Pre-qualifying multiple alternative suppliers (Correct answer)

Correct answer: Pre-qualifying multiple alternative suppliers

Pre-qualifying alternative suppliers ensures the organization can quickly switch sources when a primary supplier is disrupted.

Question 81: How should a BCM professional handle a situation where strategic planning & goal setting protocols conflict with practical constraints?

Document the conflict and seek guidance from appropriate authorities (Correct answer)
Avoid addressing the conflict entirely
Make a unilateral decision without consultation
Always ignore the protocols in favor of practicality

Correct answer: Document the conflict and seek guidance from appropriate authorities

When protocols conflict with practical constraints, the professional approach is to document the conflict and seek guidance, ensuring transparency and compliance while working toward a resolution.

Question 82: During a risk workshop, a facilitator asks participants to independently submit risk estimates before group discussion to avoid groupthink. This technique is called:

Nominal group technique
Delphi technique (Correct answer)
Brainstorming
SWOT analysis

Correct answer: Delphi technique

The Delphi technique collects anonymous expert opinions in rounds, reducing groupthink and anchoring bias in risk estimation.

Question 83: Which of the following best describes a key competency required for strategic planning & goal setting in BCM certification?

Memorization of all relevant regulations verbatim
Critical thinking and evidence-based decision making (Correct answer)
Ability to work independently without any oversight
Delegation of all complex tasks to supervisors

Correct answer: Critical thinking and evidence-based decision making

Critical thinking and evidence-based decision making is essential for strategic planning & goal setting, as professionals must analyze situations and apply knowledge appropriately.

Question 84: Which crisis communication principle helps prevent rumor spread during an incident?

Issuing a single press release after the incident is resolved
Proactively sharing timely, accurate information even if incomplete (Correct answer)
Delaying all announcements until full information is available
Restricting all communication to senior leadership only

Correct answer: Proactively sharing timely, accurate information even if incomplete

Proactively communicating what is known, even if incomplete, fills the information vacuum that rumors exploit and builds stakeholder trust.

Question 85: Which of the following best describes a key competency required for stakeholder communication & reporting in BCM certification?

Critical thinking and evidence-based decision making (Correct answer)
Memorization of all relevant regulations verbatim
Ability to work independently without any oversight
Delegation of all complex tasks to supervisors

Correct answer: Critical thinking and evidence-based decision making

Critical thinking and evidence-based decision making is essential for stakeholder communication & reporting, as professionals must analyze situations and apply knowledge appropriately.

Question 86: Which documentation practice is most important for stakeholder communication & reporting in the BCM field?

Recording only successful outcomes
Maintaining complete, accurate, and timely records (Correct answer)
Using informal notes instead of official records
Documenting only when legally required

Correct answer: Maintaining complete, accurate, and timely records

Maintaining complete, accurate, and timely records is crucial for accountability, quality assurance, and legal compliance in stakeholder communication & reporting.

Question 87: Which of the following is an essential step in the plan development phase of BCM?

Creating a communication strategy.
Identifying non-critical processes.
Identifying and prioritizing critical business functions. (Correct answer)
Defining the marketing plan.

Correct answer: Identifying and prioritizing critical business functions.

An essential step in the plan development phase of Business Continuity Management (BCM) is identifying and prioritizing critical business functions. This foundational activity, often done through a Business Impact Analysis, determines which operations are vital for the organization's survival and guides the allocation of recovery resources and strategy development.

Question 88: The BCM team documents that regulatory reporting must resume within 4 hours of any disruption to avoid legal penalties. This 4-hour requirement directly informs which BIA output?

Recovery Time Objective (RTO) (Correct answer)
Recovery Point Objective (RPO)
Work Recovery Time (WRT)
Maximum Tolerable Downtime (MTD)

Correct answer: Recovery Time Objective (RTO)

The RTO for the regulatory reporting function must be set at or below 4 hours to satisfy the compliance requirement without incurring penalties.

Question 89: Why is it important to document 'dependencies' in a Business Continuity Plan?

To satisfy ISO 9001 requirements
For financial accounting purposes
To reduce insurance premiums
Because critical functions depend on other processes, systems, staff, and suppliers that must also be recovered or available for resumption to succeed (Correct answer)

Correct answer: Because critical functions depend on other processes, systems, staff, and suppliers that must also be recovered or available for resumption to succeed

Documenting dependencies ensures that all interdependent processes, systems, staff, and suppliers needed to support a critical function are identified and included in recovery planning.

Question 90: In BCM, what is a 'mutual aid agreement'?

A vendor SLA for hardware replacement
A government disaster relief contract
An insurance policy supplement
A formal arrangement between two or more organizations to provide resources or assistance to each other during a disruption (Correct answer)

Correct answer: A formal arrangement between two or more organizations to provide resources or assistance to each other during a disruption

A mutual aid agreement is a formal arrangement where two or more organizations agree to support each other with resources, facilities, or personnel during a disruption.

Question 91: Which exercise type tests the actual failover of systems and processes to an alternate site without prior notification to participants?

Surprise drill (Correct answer)
Structured walk-through
Tabletop exercise
Parallel test

Correct answer: Surprise drill

A surprise drill (unannounced exercise) tests real-world response by activating recovery procedures without advance warning to participants.

Question 92: What role does the Risk and BIA play in the overall business continuity planning process?

It helps develop a crisis management team.
It helps identify and prioritize critical business functions. (Correct answer)
It identifies the business’s marketing strategies.
It provides guidelines for IT security.

Correct answer: It helps identify and prioritize critical business functions.

The Risk and Business Impact Analysis (BIA) is foundational to the overall business continuity planning process. It systematically identifies which business functions are essential, assesses the impact of their disruption, and helps prioritize them for recovery. This ensures that resources are focused on the most critical areas, maximizing resilience.

Question 93: Which of the following best describes a key competency required for conflict resolution & mediation in BCM certification?

Ability to work independently without any oversight
Memorization of all relevant regulations verbatim
Critical thinking and evidence-based decision making (Correct answer)
Delegation of all complex tasks to supervisors

Correct answer: Critical thinking and evidence-based decision making

Critical thinking and evidence-based decision making is essential for conflict resolution & mediation, as professionals must analyze situations and apply knowledge appropriately.

Question 94: In a BCM context, what does a 'reciprocal agreement' between two organizations involve?

Regular joint BCP testing exercises
Joint investment in a shared hot site
Sharing a common insurance policy
Each organization agreeing to host the other in the event of a disaster (Correct answer)

Correct answer: Each organization agreeing to host the other in the event of a disaster

A reciprocal agreement means two organizations commit to providing each other with recovery space and resources if either suffers a major disruption.

Question 95: What is a common challenge professionals face when applying strategic planning & goal setting principles in Business Continuity Management Certification?

Balancing theoretical knowledge with practical application (Correct answer)
Having too much support from colleagues
Lack of any professional development opportunities
Excessive simplicity of industry regulations

Correct answer: Balancing theoretical knowledge with practical application

Balancing theoretical knowledge with practical application is a well-recognized challenge, as real-world scenarios often present complexities not covered in standard training.

Question 96: Which regulatory requirement most commonly drives US financial institutions to maintain formal BCM programs?

SOX Section 404
HIPAA Security Rule
FFIEC IT Examination Handbooks (Correct answer)
PCI-DSS Requirement 12

Correct answer: FFIEC IT Examination Handbooks

The FFIEC IT Examination Handbooks provide comprehensive BCM guidance and compliance expectations for US financial institutions.

Question 97: What is the purpose of a 'Recovery Point Objective' (RPO) in BCM planning?

To set the budget for recovery operations
To identify the recovery team leader
To define the physical recovery site location
To define how far back in time data can be restored without unacceptable business impact (Correct answer)

Correct answer: To define how far back in time data can be restored without unacceptable business impact

RPO defines the maximum acceptable amount of data loss measured in time—how far back data can be restored before the loss becomes unacceptable to the business.

Question 98: Which quality improvement method is most applicable to strategic planning & goal setting in Business Continuity Management Certification?

Implementing changes without measuring outcomes
Ignoring feedback and maintaining status quo
Plan-Do-Check-Act (PDCA) continuous improvement cycle (Correct answer)
Making changes only when mandated by regulators

Correct answer: Plan-Do-Check-Act (PDCA) continuous improvement cycle

The PDCA cycle is widely recognized as the most effective quality improvement method, allowing BCM professionals to systematically improve strategic planning & goal setting practices.

Question 99: Which metric best measures the effectiveness of a BCP training program over time?

Cost per trainee
Number of training hours completed
Number of employees who attended at least one session
Percentage improvement in exercise scores across successive tests (Correct answer)

Correct answer: Percentage improvement in exercise scores across successive tests

Tracking improvement in exercise performance scores over successive tests directly measures whether training is translating into better preparedness.

Question 100: In a BIA interview, a department head says their function has a 'low' impact if unavailable for one day but 'critical' impact after three days. This escalating impact profile is called:

Impact threshold progression
Cascading failure analysis
Temporal impact escalation
Time-sensitive impact scaling (Correct answer)

Correct answer: Time-sensitive impact scaling

Time-sensitive impact scaling describes how the severity of disruption consequences increases over time, informing MTD and recovery prioritization.

DRI Certified Business Continuity Professional (CBCP) Exam

The CBCP certification validates an individual's ability to develop, implement, and manage business continuity and disaster recovery programs.

100

Questions

120 min

Time Limit

75%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds